Good day everyone, to meet emerging requirements I am attempting to configure in a lab PKI login, via SSH, to Cisco IOS. I am using information from various Cisco sources but most are similar to the below. Test configuration is also below and PuttyCAC is configured to use a CAPI certificate but no matter what I do IOS and Putty will only agree on ssh-rsa. I know using Radius is unusual, however it has broader support across platforms than TACACS+
Configuring SSH with x509 authentication on IOS devices
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/212178-Configuring-SSH-with-x509-authentication.html
aaa group server radius WINRADIUS
server name RADIUS
aaa authentication login local_access local enable
aaa authorization config-commands
aaa authorization exec WINRADIUS group radius local
aaa authorization network WINRADIUS group radius local
aaa authorization configuration WINRADIUS group radius
crypto pki trustpoint CA
enrollment mode ra
enrollment url http://xxx.xxx.xxx.xxx:80/CertSrv/mscep/mscep.dll
usage ssl-server
usage ssl-client
serial-number
fqdn IR01.xxx
ip-address xxx.xxx.xxx.xxx
subject-name cn=IR01.xxx
subject-alt-name IR01.xxx
revocation-check ocsp
source interface Vlan11
rsakeypair PKI 4096
authorization list WINRADIUS
authorization username subjectname commonname
hash sha256
!
ip ssh maxstartups 2
ip ssh time-out 60
ip ssh source-interface Vlan11
ip ssh rsa keypair-name PKI
ip ssh logging events
ip ssh version 2
ip ssh server certificate profile
ip ssh server algorithm mac hmac-sha1
ip ssh server algorithm encryption aes256-ctr
ip ssh server algorithm hostkey x509v3-ssh-rsa
ip ssh server algorithm authentication publickey keyboard
ip ssh server algorithm publickey x509v3-ssh-rsa
ip radius source-interface Vlan11
radius server RADIUS
address ipv4 xxx.xxx.xxx.xxx auth-port 1812 acct-port 1813
key xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Anyone have any ideas please?
