Perfect Forward Secrecy for IPsec: every session negotiates new Diffie-Hellman keys from a configured DH group. If the two sides differ, tunnel negotiation errors out with No proposal chosen.
Also called perfect forward secrecy.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains PFS in context, with comparison tables and the common traps.
Terms in this definition
- IPsec
Internet Protocol Security is the set of protocols that negotiates and encrypts the tunnels used by VNet-to-VNet and site-to-site VPNs.
- DH
Diffie-Hellman groups decide how keys are exchanged in NSX IKE and IPSec profiles. If the two VPN ends choose different groups, the tunnel fails with "No proposal chosen".
- KEYS
Lists the column or columns that identify each target row uniquely in an AUTO CDC statement.
- DH group
The Diffie-Hellman group chosen for key exchange during IKE Phase 1 (Main Mode) in a custom IPsec/IKE policy, such as DHGroup24 or DHGroup14.
Related terms
- Custom IPsec/IKE policy
Set of algorithms for IKE Phase 1 and IPsec Phase 2, together with DH and PFS groups and SA lifetimes, applied to one connection rather than the gateway; each connection takes one policy, and every parameter has to be filled in.
- PFS group
Perfect Forward Secrecy group, the Diffie-Hellman group applied in IPsec Quick Mode (Phase 2). A frequent reason for tunnels failing on policy mismatch is PFS being on at one end only.