ipsecSecurityProfileEnablePfs 1.3.6.1.4.1.838.3.14.1.2.1.9

When enabled PFS is enforced. This requires generation on new key material for each protocol SA (i.e., non ISAKMP SA). The default is 'false(2)'.