set pfs

Last Updated : Oct 15, 2026 |
Specifies whether each IKE phase 2 negotiation will employ Perfect Forward Secrecy (PFS), and if yes, which Diffie-Hellman group to employ. PFS ensures that even if someone were to discover the long-term secret(s), the attacker would not be able to recover the session keys, both past and present. In addition, the discovery of a session key compromises neither the long-term secrets nor the other session keys.
Prolog information
Use no set pfs to disable PFS for IKE phase 2 (default setting).

Syntax

set pfs [group14]
Note:
Using set pfs with no parameters sets the PFS group to 14.

Parameters

Parameter
Description
Possible Values
Default Value
group14
Keyword specifying that IKE employ the 2048-bit Diffie-Hellman prime modulus group

User level

read-write

Context

crypto ipsec transform-set

Example

To specify that IKE employs the 2048-bit Diffie-Hellman prime modulus group:
Gxxx-001(config-transform:ts1)# set pfs group14