command set dh-params 8192 impact ?

[usmansa1]

Hi, 

I am checking the documents for security best practices and found that we can use the command set dh-params 8192 to force the second entity to use the stronger group for encryption, I want to know what is the overall impact of this command and specifically impact of this command on existing IPSEC configurations. For example if I have installed IPSEC tunnels in my environment with group 4 or group then how this command will impact me and secondly if tomorrow another client comes and say that he does not support 8192 in its system or for any reason he doesn't want to use the same group can we use other groups for that particular IPSEC ?

[amrit]

DH param 8192 is DH bit modulus group 18, which will make the encryption keys a lot longer. That means more computation power is required for the IPsec decryption. For more details, You can check the RFC 3526.  So, if the other side doesn't support this then you won't be able to use it

[usmansa1]

Hi Amrti, 

Thanks alot for your response, if I wont be able to use it then do i have to configure back again to 2048 or FGT will automatically select the suitable algorithm