1

I had to disable PFS in the IPsec rules on one of our ASAs to allow Android Gingerbread clients to connect. Does doing so compromise the security of the VPN? Communications are AES-256 or AES-128 with group password. From my research, it seems like PFS is considered by some to be questionable, and to tell you the truth I never really noticed it before now, so I just don't know what to do here.

ETA: since this is apparently relevant, the ASA in question is used only for Remote Access, no lan-to-lan.

1 Answer 1

2

It depends a bit on how you've got the VPN configured. If you're using pre-shared keys, then PFS isn't doing much anyway. If you're using certificates, capturing a session initialization and the secret key of a device is compromised (say a phone is stolen, making both of these trivial) then it's significantly easier to calculate the key on the ASA (making it easier for someone who can capture any VPN session to decrypt the session).

In any case it would still take significant computational time to crack the keys and ability to eavesdrop on VPN connections.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .