Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1119
  • Last Modified:

I am using the ASDM VPN Wizard on my ASA 5505. I'm not sure if I should check Enable Perfect Forwarding Secrecy (PFS)?

I am creating a VPN between a Cisco ASA 5505 and a Cisco 2801 Router.  When I am going through the VPN Wizard on the ASA, it has a check box that is check by default that says "Enable Perfect Forwarding Secrecy (PFS)?  I didn't see anything like that on the 2801.  Do I leave that checked on the ASA.  When I do leave it checked I have this entry on my crypto map "crypto map outside_map 1 set pfs group 1".  There is nothing like that on the 2801 side.  The ASA is not in production yet, that why I havn't tested it to see if it works the way I have it configured now.  I'm trying to get is preconfiged and wasn't sure what the above meant, or if I needed it.  Thanks
0
Crossroads305
Asked:
Crossroads305
  • 2
  • 2
1 Solution
 
MikeKaneCommented:
It depends on the endpoint of the VPN.   For example, the linksys RV042 does not use the PFS when doing a VPN to the ASA.  

Just make sure that both sides match exactly.  

Perfect Forward Secrecy (PFS) allows you to add an additional security parameter to tunnel sessions. PFS means that every time encryption and/or authentication key are computed, a new Diffie-Hellman Key Exchange is included.
0
 
Crossroads305Author Commented:
The end point is a cisco 2801.  I don't see PFS being used on the 2801 side, so I won't use it on the ASA side.  Thanks
0
 
MikeKaneCommented:
PFS just adds a little extra security.    For it to work, both sides must match exactly.   So if its off on the 2800, remove it from the ASA.  

If you can enable it on the 2800, a little extra security never hurts.
0
 
Crossroads305Author Commented:
Thanks
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now