topic Re: firepower SSH ：matching cypher is not support in Network Security

firepower SSH ：matching cypher is not support

fly — Tue, 21 Feb 2023 02:48:28 GMT

we upgrade firepower 2130 from 9.10.1 to 9.16

.4.14

after ugrade we can't login firepower asa by using ssh xshell ，can login fxos

from debug got

ssh 2 matching cypher is not support

actually from asa ssh cypher is support i change cypher on client but no use

i tried reconfig asa regenerrate rsa key clear xshell key cache but no use

give me some clue？

Re: firepower SSH ：matching cypher is not support

balaji.bandi — Tue, 21 Feb 2023 03:57:45 GMT

Have you tried with different client like Putty or secure CRT latest one ?

post below output from ASA :

#show ip ssh

# show ssh ciphers

also try below config see if that fix the issue ?

ssl cipher tlsv1.2 all

Re: firepower SSH ：matching cypher is not support

fly — Tue, 21 Feb 2023 06:48:59 GMT

Thank you

i check show ssh cipher found asa support cipher which debug said no support

I tried different ssh client putty crt xshell

and clear key cache on xshell

we will try latest ssh client and tlsv1.2 command

Re: firepower SSH ：matching cypher is not support

fly — Tue, 21 Feb 2023 07:53:02 GMT

we tried

ssh cipher encryption all

ssh cipher intergrad all

but no use
from debug same error
ssh2 0 matching ciper is not support:aes256-cbc

I tried many cipher  but same error

Re: firepower SSH ：matching cypher is not support

fly — Tue, 21 Feb 2023 08:19:48 GMT

this is weird,

from firepower debug : asa and ssh client found match cipher , bug why asa can't support, from show ssh , I can see asa enable match cipher , we upgrade from 9.10.1 to 9.16.4.14 , it is weired , I can't find any usefule infortion

I change cipher on asa , regenarate rsa key , clear key cache on client xshell, change client computer , and change xshell to crt , but no use , asa report same error from debug.

Re: firepower SSH ：matching cypher is not support

fly — Tue, 21 Feb 2023 10:46:33 GMT

I tried this command but got error

ssl cipher tlsv1.2 all

error：invalid version/level combination ：no compatible cipher found

error：unable to update ciphers

Re: firepower SSH ：matching cypher is not support

Marvin Rhoads — Tue, 21 Feb 2023 12:35:28 GMT

What are the versions of Xshell you tried? I've used version 6 and 7 both and they work fine with newer ASA code. Older versions of terminal emulator programs (Xshell, SecureCRT, Putty etc.) may not support newer ciphers.

The newer ASA code deprecated some older ciphers. Your attempt to change ssl ciphers has nothing to do with ssh ciphers.

Please share the output of "show run ssh".

Re: firepower SSH ：matching cypher is not support

balaji.bandi — Tue, 21 Feb 2023 14:18:31 GMT

Have you tried with different client like Putty or secure CRT latest one ?

post below output from ASA :

#show ip ssh

# show ssh ciphers