The name of the transform-set

The encryption algorithm used by the transform-set. Possible values are esp-aes, esp-aes-192, esp-aes-256 and esp-null (no encryption).

The authentication algorithm used by the transform-set. Possible values are esp-md5-hmac and esp-sha-hmac.

The IP compression algorithm used by the transform-set. The only possible value is comp-lzs.

Use the set pfs command to specify whether each IKE phase 2 negotiation employs Perfect Forward Secrecy (PFS), and if yes, which Diffie-Hellman group to employ. PFS ensures that even if someone were to discover the long-term secret(s), the attacker would not be able to recover the session keys, both past and present. In addition, the discovery of a session key compromises neither the long-term secrets nor the other session keys. The default setting is no set pfs.

Use the set security-association lifetime seconds command to set the security association lifetime in seconds.

Use the set security-association lifetime kilobytes command to set the security association lifetime in kilobytes.

Use the mode command to set the IPSec mode (tunnel or transport). Transport mode does not add an additional IP header (i.e., a tunnel header), but rather uses the original packet’s header. However, it can be used only when the VPN tunnel endpoints are equivalent to the original packet’s source and destination IP addresses. This is generally the case when using GRE over IPSec. Note that transport mode cannot be used unless the remote VPN peer supports that mode and was configured to use it.

Gxxx-001001(config-transform:ts1ts1)# set pfs group2
Done!
Gxxx-001(config-transform:ts1)# set security-association lifetime seconds 
7200
Done!
Gxxx-001(config-transform:ts1)# set security-association lifetime 
kilobytes 268435456
Gxxx-001(config-transform:ts1)# mode tunnel
Done!