OpenVPN tunnels are secure, no need to worry about that with this issue. This issue applies purely to the web services. By default ciphers are allowed that supports PFS, and a few for backwards compatibility reasons that don't support PFS. Most ordinary systems will select the more secure ciphers that use PFS. If you run a penetration test with software that will negotiate for the lesser ciphers that don't support PFS, then you will get a result that states that PFS is not supported for those ciphers. If you want to get rid of this warning then disable any ciphers that don't do PFS.
https://docs.openvpn.net/docs/access-server/openvpn-access-server-command-line-tools.html#selecting-web-server-ciphersuites
Use a site such as Qualys Labs SSL to test your system and see which ciphers you want to disable.
So in short, yes, of course AS supports PFS, out of the box. There's no cloak and dagger going on. Just take a look at the cipher suite string and adjust it to your own wishes.
