Showing results for 
Search instead for 
Did you mean: 

SSH slow on ASR9001 : 1s delay to get KEXDH_REPLY



We run asr9001 with XR 6.1.3, and we have a very long delay to login w/ SSH 1 or 2 to the device compare to IOS device.

After investigation, the there is 1s delay between the client KEXDH_INIT and the server (XR) KEXDH_REPLY.


After debug ssh server on the XR device, we see the following:


RP/0/RSP0/CPU0:Nov 17 08:05:13.661 : SSHD_[65874]: Received KEXDH_INIT
RP/0/RSP0/CPU0:Nov 17 08:05:13.661 : SSHD_[65874]: Calling DH algorithm setting with group14
RP/0/RSP0/CPU0:Nov 17 08:05:13.661 : SSHD_[65874]:  Getting the parameter inside (Func: set_dh_param_groups)
RP/0/RSP0/CPU0:Nov 17 08:05:13.661 : SSHD_[65874]: After geting the parameter we are calling the first phase of DH
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: sshd_key_exchange: Selected key_type is RSA
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: Extracting RSA pubkey from crypto engine
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: Retreiving 512 bit RSA host key-pair
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: bloblen = 87
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: exponent = 3, modulus = 65
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: Calculating kex hash with client_str = SSH-2.0-SecureCRT_7.3.7 (x64 build 1034)  (len = 40)
RP/0/RSP0/CPU0:Nov 17 08:05:14.539 : SSHD_[65874]: server_str = SSH-1.99-Cisco-2.0  (len = 18)
RP/0/RSP0/CPU0:Nov 17 08:05:14.542 : SSHD_[65874]: Sending KEXDH_REPLY


You clearly see that XR start with "After geting the parameter we are calling the first phase of DH", and then 1s later send the key_echange "sshd_key_exchange: Selected key_type is RSA".


We have disable vrf, disable domain-lookup, all ACL.

The config is like this:


domain lookup disable
interface MgmtEth0/RSP0/CPU0/0
 description MGMT
 ipv4 address

router static
 address-family ipv4 unicast
  x.x.x.x/24 MgmtEth0/RSP0/CPU0/0 192.18.12.x description NOC
ssh server vrf default

RP/0/RSP0/CPU0:xxx2#show cry ke my r
Fri Nov 17 09:30:04.735 UTC
Key label: the_default
Type     : RSA General purpose
Size     : 1024
Created  : 08:29:19 UTC Fri Nov 17 2017
Data     :
 30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00C55F0F
 CAD79136 49BA3746 B3949856 565CCE76 62F39A92 3BBB7171 34A02876 D9171300
 7EF62020 4C85511E 802181C3 122E1553 91A92B65 6CF6EBD6 6DA9B3F5 42E20F44
 7B4931F4 9B52F876 66943384 02C47472 802DB637 DA554A22 604E8BD1 56C0480A
 9DBD077E D3401883 C173CA91 880CE273 6DB4D939 87779DDE FC3476A1 25020301




With automatic login, we have 100ms to login to any IOS box, but around 1.5s to all XR boxes. Any idea why the first phase of DH take so long ?