Diffie Hellman groups

This setting specifies whether perfect forward secrecy (PFS) is used when negotiating the security association, and if so, which Diffie-Hellman group is used. The default setting is None. If PFS is used, each phase 2 key is derived independently through a separate Diffie-Hellman exchange. With PFS, if a single key is compromised, the integrity of subsequently generated keys is not affected.


Rule:This security level cannot be used in a stack configured for FIPS 140 if the following groups are selected:

Group 1

Group 2

Group 5