ssh from cisco router to cisco ASA 5506 version 9.14(2)15

[faruk.zaimovic]

Hello, 

I made an upgrade cisco ASA 5506-X to  version 9.14(2)15 and now I have problem making ssh connection from the Cisco router to Cisco  5506-X.

ssh -l xxxx 10.10.10.1
[Connection to 10.10.10.1 aborted: error status 0]

debuh ssh on cisco ASA 5506-x.

debug ssh
debug ssh enabled at level 1
ASA5506-X# Device ssh opened successfully.
SSH2: SSH client: IP = '10.10.10.2' interface # = 9
SSH: host key initialised
SSH2: starting SSH control process
SSH2: Exchanging versions - SSH-2.0-Cisco-1.25

SSH2: send SSH message: outdata is NULL

server version string:SSH-2.0-Cisco-1.25
SSH2: receive SSH message: 83 (83)
SSH2: client version is - SSH-2.0-Cisco-1.25

client version string:SSH-2.0-Cisco-1.25

SSH2 2: SSH2_MSG_KEXINIT sent
SSH2 2: SSH2_MSG_KEXINIT received
SSH2 0: no matching mac found: client hmac-sha1,hmac-sha1-96 server hmac-sha2-256
SSH2 2: ssh: kex_choose_conf error
SSH2 0: key exchange failed to completeSSH2: Session disconnected by SSH server - error 0x00 "Internal error"
Device ssh opened successfully.
SSH2: SSH client: IP = '10.10.10.2' interface # = 9
SSH: host key initialised
SSH2: starting SSH control process
SSH2: Exchanging versions - SSH-2.0-Cisco-1.25

SSH2: send SSH message: outdata is NULL

server version string:SSH-2.0-Cisco-1.25
SSH2: receive SSH message: 83 (83)
SSH2: client version is - SSH-2.0-Cisco-1.25

client version string:SSH-2.0-Cisco-1.25

SSH2 2: SSH2_MSG_KEXINIT sent
SSH2 2: SSH2_MSG_KEXINIT received
SSH2 0: no matching mac found: client hmac-sha1,hmac-sha1-96 server hmac-sha2-256
SSH2 2: ssh: kex_choose_conf error
SSH2 0: key exchange failed to completeSSH2: Session disconnected by SSH server - error 0x00 "Internal error"

Does anybody have an idea how to solve it?.

Thank you very much. 

[balaji.bandi · Accepted solution]

SSH2 0: key exchange failed to completeSSH2: Session disconnected by SSH server - error 0x00 "Internal error"

Try to re-generate Crypto key :

crypto key generate rsa general-keys modulus XXXX

Also, make sure your Router Supports new Keys?

[faruk.zaimovic]

Thank you. 

Problem was with cipher integrity custom on Cisco ASA, Router didn't support newer key. 

I solved it.