Can't SSH into Switch

[chueymtz]

I get this error when trying to telnet

2023/12/11 15:17:43.606 {nginx_R0-0}{1}: [ngx_core] [29797]: UUID: 0, ra: 0, TID: 0 (ERR): [29803] 2023/12/11 10:17:43 [crit] 29803#0: *3520 SSL_shutdown() failed (SSL: error:140E0197:SSL routines:SSL_shutdown:shutdown while in init) while SSL handshaking, client: 10.78.2.227, server: 0.0.0.0:443

[balaji.bandi]

Not sure what is the device model and what IOS code running.

as per the message it try to connect port 443 - not SSH port 22 here, also looks like you have handshake issue between client and the device you connecting.

[bigevilbeard]

@chueymtz  The error message you are receiving is indicating that there is an issue with the SSL/TLS handshake when trying to telnet to your Cisco switch. The specific error code is 140E0197, which means that the SSL/TLS handshake was aborted while it was still in the initialisation phase. This could be caused by a couple of thing

• An incorrect SSL/TLS cipher suite being negotiated If the client and server are not using compatible cipher suites, the handshake will fail.
• A network configuration issue preventing the SSL/TLS connection from being established. Is there a firewall rule blocking the connection, or routing issue that is causing the packets to be lost
• A software bug, check your image or bug tool

Hope this helps.

[chueymtz]

I'm using superputty and it worked last week I don't think i've made any other changes but I can still access the switch using the webgui. Do you think it oculd be a configuration issue?

[balaji.bandi]

something sure might have changed, the logs shows not related to SSH - when you SSH collect the logs from Device Cli. alos post show ip ssh (output from device)

[MHM Cisco World]

show tcp brief 
share this here 
the 443 is for http so there is conflict between two SSH and HTTP since both use TCP L4. 
share show tpc brief 
let see the IP and port use 
MHM

[chueymtz]

#show tcp brief
TCB Local Address Foreign Address (state)
7FD93A6406D0 192.168.1.6.443 192.168.1.5.47444 ESTAB

[MHM Cisco World]

so this is tcp session 
clear tcp tcb*

do clear tcp then try connect again using SSH

[chueymtz]

Tried this but it didn't fix it

[MHM Cisco World]

show tcp brief 
are you see same entry ?
if Yes 
then try 

clear tcp tcb <the number if tcb appear in table first number in line >

MHM

[MHM Cisco World]

0.0.0.0 Server ?
can I see the config of SSH ?

[chueymtz]

#show ip ssh
SSH Enabled - version 1.99
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96
KEX Algorithms:diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 2048 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): TP-self-signed-417665234
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCF9S5HGof40OyzSpSO2mep5XNOMDdyyVh1vjgsKcfQ
qq1TpZjxtg6gvcWZnhI81rUPheKEak6NPjqMkbYwzEsUiSWLSPhMxuk3cyGbb0cGDyWVAv6Ai2sPaZ1Q
h3DuOSJI5JB+Zm02eQ9MXrZPpwEstT9XWzhOAzCDzgyiSIWPXuUJ7oIW3g2YJnJB8IyJBpQJdNH/wleG
1nbKsQWHRGMtNc9L3MqkEB5NLWvO+mRzeuxQp1BryuAQeLqNHfAghJx2TAL8xpaHog7UDS9FxmvgipTo
tbZYCaada4aPjsqBhQ3Rdi0Alm+s2HMwFxqjC28nIKnCfkFXXpaoJN+YvgIZ

[balaji.bandi]

thats look ok, what message you get from Putty when you try to connect ?

and same time  when you connecting port SSH 22, what logs you see on the device.

[chueymtz]

network error: connection refused

[balaji.bandi]

check command errors that explain better if you getting on putty :

https://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter10.html#errors-connrefused

But how are you able to post other console information here, if you not able to login to Switch (Console ?)

there is question asked before :

Not sure what is the device model and what IOS code running.

Also post your VTY lines configuration.

Follow below guide how to configure SSH on cisco devices.

https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html