Given a site to site IPSEC VPN most firewalls allow for the selection of which DH group the site to site tunnel will use to perform the key exchange prior to encrypting the traffic.
I have noticed that with client IPSEC VPNs typically you only have the choice of entering a pre shared key.
Do client IPSEC VPNs not use DH Groups? Do they only use the pre shared key (and since the key is pre shared there is not a need to perform a key exchange)? Do you know of any vendors who make a product that allows DH groups to be used with client IPSEC VPNs so the key exchange is dynamic and not pre shared?
I don't have a use case that requires this, I just want to make sure I understand why the Cisco ASA allows you to select a DH group for site to site IPSEC VPNs but not for client IPSEC VPNs.