Azure S2S VPN Perfect Forward Secrecy always negotiated as "None"

Question

Hello folks,

First time asking a question so please forgive me if I forgot to put enough information or formatting is wrong.
I am trying to better understand limitations of Azure S2S VPN, namely the PFS and wanted to check if someone encountered a similar situation as I did.

I have been recently looking into the topic of securing VPN phase2 (IPSec) with specific set of protocols (GCMAES256) and PFS group ECP256. I have set up a small lab environment to verify tunnel capabilities that uses Azure Virtual Hub S2S Gateway and good old Azure VNG (Standard SKU) on the other side.

Unfortunately no matter how I configure the VPN cipher settings, the IPSec PFS Group is always being shown as "None".

I have set a matching set of parameters for both phase1 and 2 on both ends of the VPN tunnel (VHG <> VNG), but even then inspecting IKE diagnostic logs shows that the negotiated tunnel is not using PFS at all (effective PFS = None).

Example of matching settings I have tried:

Phase1:
Encryption : GCMAES256
Integrity : SHA256
DH Group : ECP256

Phase2:
Encryption : GCMAES256
Integrity : GCMAES256
PFS Group : ECP256 - effective PFS for established tunnel is always "None"

I have found article *https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices* which showcases different combinations of protocols for initiator and responder. The GCMAES256 is paired with PFS Group as None for both roles, but even if I downgrade to supported AES256 / SHA256 and use PFS Group 24 or 14, the tunnel still ends up with PFS "None" in the end.

Another test that I have done was using pfSense with configured GCMAES256 for phase2 encryption and integrity along with PFS groups 14, 21 and ECP256 and leaving the Azure Virtual Hub S2S Gateway on default and later matching settings. The result was still the same - PFS negotiated to "None"

Side notes:

• The way I am gathering information on effective PFS settings for Azure VNG is via downloading SAs when the tunnel is established. For Virtual Hub Gateway I am using Azure PowerShell cmdlet that shows connected tunnel settings and double checking IKE diagnostic logs in Storage Account / LA workspace.
• I have stumbled upon a few articles from security vendors such as Fortinet that recommend to disable PFS when creating tunnel to Azure VNG. This adds to my confusion as to whether we can actually use PFS for Azure S2S VPN tunnels?

Did anyone ever encountered a similar situation? Perhaps I am reading the guidelines for ciphers compatibility incorrectly? Is there any way to make use of specific PFS group for phase2 of S2S VPN tunnel, or does it have to be "None" (at least for now)?

Thank you in advance for any tips and feedback.

Answer 1

Hello @confusedfish-8493 , Thank you for reaching out.

Have you set-up any Diffie-Hellman group for phase2 negotiations? As per the FAQ here Diffie-Hellman Group 19 supports PFS ECP256.
If it helps you can also configure a packet capture on your Azure VPN gateway and see if it helps pinpoint the issue. Thank you!