PFS & failures at rekey

Perfect forward secrecy

Lesson 13 of 20 · 12 min · Module 4: Keeping the tunnel up

Someone who records your encrypted traffic today may obtain a key next year. Perfect forward secrecy limits what that key can open.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Explain what perfect forward secrecy protects against
Configure a PFS group on the IPsec proposal
Recognise a tunnel that fails at its first rekey

The idea

With PFS, every rekey of the child SA includes a fresh Diffie-Hellman exchange, so the new keys cannot be derived from the old ones. Both sides must use the same group. In IKEv2 the first child SA is created together with the IKE SA and does not use the PFS group, so a mismatch stays invisible until the first rekey: the tunnel comes up, works for an hour, and then drops.

ipsec proposal aes128 sha256 pfs dh19

01What PFS adds

Without PFS, child SA keys are derived from the keying material of the IKE SA. If that material is ever compromised, every child SA made from it can be decrypted. With PFS each child SA has its own independent secret.

02The hourly drop

"It works for an hour and then stops for a minute" is the signature of a PFS mismatch on IKEv2: one side asks for a group during the rekey and the other does not offer it. The interval equals the child SA lifetime, which is a strong clue.

03PFS on real devices

PFS is a setting of the IPsec (phase 2) part, with its own group.

# FortiGate
config vpn ipsec phase2-interface
    edit "to-branch-p2"
        set pfs enable
        set dhgrp 14
    next
end

# Huawei USG
ipsec policy map1 10 isakmp
 pfs dh-group14

# Cisco IOS
crypto map VPN 10 ipsec-isakmp
 set pfs group14

Your turn

Users report that the connection to the branch drops for about a minute every hour. The branch requires PFS with group 14 (see the panel), and this side does not use it. Add PFS to the IPsec proposal.

What the checks look for

The tunnel comes up
The child SA will rekey successfully
PFS uses group 14 on this side
The tunnel is stable over time

Try it in the editor →

Take this with you

PFS gives every child SA an independent secret. Both sides need the same group, and a mismatch appears only at the first rekey.

Go a little further

Change the group to dh19 on this side only and run the lab. The tunnel still comes up; read the Rekey line in the Output tab.