ADTRAN 1000R Series set pfs [group1

Command Reference Guide Crypto Map IKE Command Set

set pfs [group1 | group2]

Use the set pfs command to choose the type of perfect forward secrecy (if any) that will be required during

IPSec negotiation of security associations for this crypto map. Use the no form of this command to require

no PFS.

Syntax Description

group1 Requires IPSec to use Dif fie-Hellman Grou p 1 (768-bit modu lus) exchange dur ing

IPSec SA key generation.

group2 Requires IPSec to use Diffie-Hellman Grou p 2 (1024 -b it mo dulu s) exchange

during IPSec SA key generation.

Default Values

By default, no PFS will be used during IPSec SA key generation.

Applicable Platforms

This command applies to the NetVanta 300, 1000R, 2000, 3000, 4000, and 5000 and Total Access 900

Series units.

Command History

Release 4.1 Command was introduced.

Functional Notes

If left at the default setting, no perfect forward secrecy (PFS) will be used during IPSec SA key generation.

If PFS is specified, then the specified Diffie-H ellman Group exchange will be used for the initial and all

subsequent key generation, thus providing no data linkage between prior keys and future keys.

Usage Examples

The following example specifies use of the Diffie-Hellman Group 1 exchange during IPSec SA key

generation:

(config-crypto-map)#set pfs group 1