Command Reference Guide

SROS Command Line Interface Reference Guide Crypto Map IKE Command Set
5991-2114 © Copyright 2005 Hewlett-Packard Development Company, L.P. 402
set pfs [group1 | group2]
Use the set pfs command to choose the type of perfect forward secrecy (if any) that will be required during
IPSec negotiation of security associations for this crypto map. Use the no form of this command to require
no PFS.
Syntax Description
group1 IPSec is required to use Diffie-Hellman Group 1 (768-bit modulus) exchange
during IPSec SA key generation.
group2 IPSec is required to use Diffie-Hellman Group 2 (1024-bit modulus) exchange
during IPSec SA key generation.
Default Values
By default, no PFS will be used during IPSec SA key generation.
Command Modes
(config-crypto-map)# Crypto Map IKE Configuration Mode
Functional Notes
If left at the default setting, no perfect forward secrecy (PFS) will be used during IPSec SA key generation.
If PFS is specified, then the specified Diffie-Hellman Group exchange will be used for the initial and all
subsequent key generation, thus providing no data linkage between prior keys and future keys.
Usage Examples
The following example specifies use of the Diffie-Hellman Group 1 exchange during IPSec SA key
generation:
(config-crypto-map)#set pfs group 1