What are the recommended PFS settings in SANGFOR?

What are the recommended PFS settings in SANGFOR? I have NSF-7100A-I.
For phase 1 I picked AES256 for encryption, SHA-256 for Hashing, D-H Group 14. For phase 2 I picked ESP, AES256, SHA-256, and PFS Group 14. But the device is telling me "the selected PFS and the recommended PFS must be the same." So I want to know what the recommended PFS is. Thanks in anticipation.

The error suggests a mismatch between the selected Perfect Forward Secrecy (PFS) parameters in Phase 2 and the PFS settings required for your SANGFOR NSF-7100A-I device. Typically, Group 14 (2048-bit) is the standard PFS group used in Phase 2, but the device may need either Group 2 or Group 14 for both Phase 1 and Phase 2 to maintain consistent cryptographic settings for the VPN tunnel.

The problem notice you are seeing usually indicates that the PFS (Perfect Forward Secrecy) settings you chose in Phase 2 do not correspond to the PFS parameters that your SANGFOR NSF-7100A-I device requires or recommends. Group 14 (2048-bit) is the suggested PFS group for Phase 2 for the majority of systems. To maintain consistency, the device may suggest Group 2 or Group 14 for both Phase 1 and Phase 2 if it specifies a different group or version.

Hi,
The recommended PFS is group 14 (2048-bit) is widely considered a good balance between security and performance.

The choice of PFS settings is certainly influenced by the characteristics of both the involved endpoints but there are certainly DH algorithms that are more secure than others.
The security of a Diffie-Hellman (DH) group depends on the size and type of the underlying prime numbers or elliptic curves used.

The most secure Diffie-Hellman group is currently considered to be Group 24 (2048-bit ECP) or higher, offering stronger encryption and resistance to attacks; the security of a Diffie-Hellman (DH) group depends on the size and type of the underlying prime numbers or elliptic curves used.

Group 24 (2048-bit ECP) uses elliptic curve cryptography (ECC), which provides high security with shorter key lengths, making it efficient and secure.

Group 14 (2048-bit MODP) > With a 2048-bit modulus, this group offers a solid balance between computational requirements and security, resisting most known types of cryptographic attacks.

Groups 15 and 16 (3072 and 4096-bit MODP) > These groups offer higher security levels due to their larger key sizes, making them more resistant to attacks but at the cost of increased computational overhead.

Group 18 (8192-bit MODP) > This group provides extremely high security levels, suitable for environments where protection against future quantum computer attacks is considered.

So make sure that the FPS settings of the involved VPN endpoints match and ensure a sufficient level of security, deprecating any obsolete DH groups.

Hi, as i konw, the pfs settings are based by the device you have on the other side of the vpn site-to-site. I don't remember any specific settings that are recommended abotu pfs on Sangfor NSF.