Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to disable PFS in the IPsec rules on one of our ASAs to allow Android Gingerbread clients to connect. Does doing so compromise the security of the VPN? Communications are AES-256 or AES-128 with group password. From my research, it seems like PFS is considered by some to be questionable, and to tell you the truth I never really noticed it before now, so I just don't know what to do here.

ETA: since this is apparently relevant, the ASA in question is used only for Remote Access, no lan-to-lan.

share|improve this question
up vote 2 down vote accepted

It depends a bit on how you've got the VPN configured. If you're using pre-shared keys, then PFS isn't doing much anyway. If you're using certificates, capturing a session initialization and the secret key of a device is compromised (say a phone is stolen, making both of these trivial) then it's significantly easier to calculate the key on the ASA (making it easier for someone who can capture any VPN session to decrypt the session).

In any case it would still take significant computational time to crack the keys and ability to eavesdrop on VPN connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.