Perfect Forward Secrecy forces tunnel endpoints to generate new keys for an IPsec SA Security Association using Diffie-Hellman key exchange.