Which parameter in IPsec VPN tunnel configurations is optional?

A hash algorithm (integrity/authentication algorithm such as SHA or MD5) is required in both IKE Phase 1 and IPsec Phase 2 proposals to ensure data integrity and must be explicitly agreed upon.

Lifetime defines how long security associations remain valid before renegotiation, and while defaults exist, it is a required negotiated parameter in both IKE and IPsec SA establishment.

Encryption specifying the cipher (such as AES or 3DES) is a mandatory parameter for both IKE and IPsec proposals because confidentiality is a core function of the VPN tunnel.

PFS uses an additional Diffie-Hellman key exchange during IPsec Phase 2 to derive session keys independently from the Phase 1 key material, ensuring that compromise of one session key does not expose others. However, PFS is not required for an IPsec tunnel to negotiate and function - it is an enhancement that can be omitted. When not configured, IPsec simply derives the Phase 2 keys from existing Phase 1 keying material without a separate DH exchange.