WS-C4506-E ssh/enable password failure after upgrade.

[RRmanagedservices]

Hello,

After upgrading the WS-C4506-E Cisco Catalyst 4500E Supervisor Engine 8-E from ios version 03.03.02.XO to version 03.08.08.E.

We cannot access the switch via ssh.

when we locally access via console.

we run "show ip ssh" and find: ssh disabled - version 1.99

                                               Please create RSA keys to enable SSH

at this time we try to elevate privilege by using enable password and this fails as well.

Is there a known bug for these switches?

We have attempted 2 upgrades of 10 switches and this has happened to both 4506-E so far.

[Jaderson Pessoa]

Hello,

New versions have ssh version 1 disabled for security reason, so if you have used ssh version 1 to access your device trough vty, you will need configure ssh version 2. In this case, you need recreate the RSA Keys.

1. create username and password
2. create rsa key: crypto key generate rsa 2048
3. ssh version 2
4. apply methods on line vty's. (ssh)

Regards,

[RRmanagedservices]

Jaderson,

Yes that is correct,

1. I was able to ssh into device to perform upgrade prior to reload. ( Now ssh v2 is disabled )

2. the second part of my problem is that the enable password no longer works. ( It worked to allow me in to upgrade in the first place)

so obviously I cannot elevate privilege to run commands to turn ssh v2 back on etc.

We are looking for verification of a known bug.

We will need to do a password recovery to get back into the 4506.  

[Jaderson Pessoa]

Hello,

There are many procedure to recover password, look guide below;

Cisco guide:

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/12043-pswdrec-6000.html

Using snmp to recovery password: https://www.tek-tips.com/faqs.cfm?fid=705

Mark as helpful and solved all posts that were helped you.

Regards,

[RRmanagedservices]

Thank You,

I am aware of password recovery procedures.

I am looking for a known bug that is causing my issues.

[Leo Laohoo]

The RSA keys have gone "zero".
Regenerate the RSA keys will get SSH back.

I don't think this is due to a bug with 3.8.X but I believe the bug is in 3.3.2.

[RRmanagedservices]

yes,

we understand that we have to regenerate the keys.

but part of the problem is the enable password stopped working at the same time.

here is the bug for 3.3.2

https://quickview.cloudapps.cisco.com/quickview/bug/CSCuz72344

[julian.bendix]

Hey!

It seems it lost the RSA key during reboot, that is why it was not possible to SSH in to the Box after the reboot.

For the issue with the enable password,
I was searching for bugs which we could face for the platform and/or the software version.

Couldn't find anything.

Do you need any further assistance?

Best regards
Julian