300-420 Question 198
Single answerAn organization has deployed a site-to-site IPsec VPN between its headquarters and a branch office. During a network assessment, the security team notices that the VPN is functioning correctly but lacks Perfect Forward Secrecy (PFS). The network engineer has been tasked to enable PFS for the IPsec configuration. Which configuration change should the network engineer make?
- A
Configure a Diffie-Hellman (DH) group in Phase 2 settings of the IPsec VPN.
- B
Enable NAT Traversal (NAT-T) in the Phase 1 settings of the IPsec VPN.
- C
Increase the AES encryption key size used in the IPsec tunnel.
- D
Configure a stronger hashing algorithm such as SHA-512 in both Phase 1 and Phase 2.
Show answer and explanation
Correct answer: A
Explanation
Perfect Forward Secrecy (PFS) is a critical feature that ensures the session keys used in IPsec are not derived from a single master key. This prevents an attacker from decrypting past communications if the master key is compromised. Configuring a Diffie-Hellman (DH) group in Phase 2 settings of the IPsec VPN enables PFS by requiring the generation of unique, ephemeral keys for each session.
- A. Correct.
Correct. Enabling a Diffie-Hellman (DH) group in Phase 2 ensures Perfect Forward Secrecy (PFS), as it generates unique session keys per IPsec session, preventing compromise of past keys if a single key is exposed.
- B. Incorrect.
Incorrect. NAT Traversal (NAT-T) is used to support IPsec traffic through NAT devices but does not affect PFS.
- C. Incorrect.
Incorrect. Increasing the AES key size improves encryption strength but does not ensure PFS.
- D. Incorrect.
Incorrect. Configuring stronger hashing algorithms improves data integrity but does not implement PFS.