A VPN’s Phase 2 PFS Group employs Diffie-Hellman key exchange algorithms.
These algorithms facilitate the exchange of encryption key data between VPN Peers with
a need to exchange the actual key.
These algorithms also comprise a number of different groups or versions which provide
varying degrees of performance, security, IKE version support, and related compatibility.
In this video, we cover when to change a VPN’s Phase 2 PFS Group setting, how to locate this
setting, and reconfigure it.
And, we will discuss best practices when such a change is necessary.
Phase 2 PFS Group settings may need to be changed to ensure compatibility with other
Cloud environments and CPEs.
You may also want to change a PFS Group to troubleshoot common VPN problems.
You can use your OCI console to view your tunnel’s current configuration.
Your PFS Group values appear under your tunnel’s Phase 2 custom configuration settings.
To locate and identify your OCI VPN’s current Phase 2 PFS Group setting, access your OCI
Console in a Web browser.
Then, navigate to the Networking section of your console.
Find the Customer Connectivity header.
Scroll down.
Click Site-to-Site VPN.
Here, Identify the IPSec connection string that hosts your tunnel.
Click it.
Click the actual tunnel.
And, locate and click that tunnel’s edit button.
This will expose all of the current configurations associated with your OCI VPN tunnel.
To view PFS Group-specific settings locate show advanced options.
Click it.
Scroll down.
Locate the Phase 2 (IPSec) configuration section.
And, here we see that the current PFS Group is Group 5.
If you need to make changes to this group, click the set custom configurations checkbox.
Change the group to the desired value.
Likewise, ensure that you also pass the associated Encryption Algorithm and Authentication Algorithm.
Then, save your changes.
Prior to changing your Phase 2 PFS Group in the OCI Console, be sure to review your CPE’s
or other peering device’s own Encryption Algorithm, Authentication Algorithm, and PFS
group configuration.
Ensure all of the relevant settings are supported by OCI.
Then, proceed to match all three settings in your OCI console.
Thank you for viewing this video on PFS Group settings.
Proper PFS Group configuration is important
to ensuring your tunnel connectivity and stability.
So take the time to review and implement the changes we discussed in your OCI Console.