Perfect Forward Secrecy

[humayun]

In your VPN tunnel community | Advanced VPN Properties, when do you "use perfect forward secrecy" option?

Thanks.

[Sergej]

PFS will regenerate symmetric encryption keys more often (each hour, instead of 24)
Use it when you want. Set the same on both sides.

[kva.kva]

From manual

"Perfect Forward Secrecy
The keys created by peers during IKE phase II and used for IPsec are based on a sequence of random binary digits exchanged between peers, and on the DH key computed during IKE phase I.
The DH key is computed once, then used a number of times during IKE phase II. Since the keys used during IKE phase II are based on the DH key computed during IKE phase I, there exists a mathematical relationship between them. For this reason, the use of a single DH key may weaken the strength of subsequent keys. If one key is compromised, subsequent keys can be compromised with less effort.
In cryptography, Perfect Forward Secrecy (PFS) refers to the condition in which the compromise of a current session key or long-term private key does not cause the compromise of earlier or subsequent keys. VPN-1 Pro meets this requirement with a PFS mode. When PFS is enabled, a fresh DH key is generated during IKE phase II, and renewed for each key exchange.
However, because a new DH key is generated during each IKE phase I, no dependency exists between these keys and those produced in subsequent IKE Phase I negotiations. Enable PFS in IKE phase II only in situations where extreme security is required.
The DH group used during PFS mode is configurable between groups 1, 2, and 5, with group 2 (1042 bits) being the default.

Note - PFS mode is supported only between Gateways, not between Gateways and remote access clients."