Can not ssh to other devices from 3850 switch

[Mark_Zhang]

Hi there, 

 I'm not able to ssh to other devices using 3850 Switch as SSH client.

PS:  3850 switch IOS version is: 16.3.5b  (ssh client)

       the ssh server is an ASA (9.6.3)

below is the Syslog: 

how can I solve it?

[Julio E. Moisa]

Hi

The SSH configuration should be:

conf t

hostname <name of the device>

ip domain name <domain.com example>

ip ssh version 2

ip ssh authen 3

ip ssh time 120

cryto key generate rsa <enter and type 1024 at least>

* if you are going to create local credentials*

username <user> privi 15 password <password>

line vty 0 15

login local

transport input ssh

* Do you have any ACL to allow just specific IP address to manage the devices?* The trouble could be caused because the terminal does not support the version configured, if you are using putty check the version configured on the settings on the left.

:-)

[Georg Pauwen]

Hello,

in addition to Julio's remarks, what IP address are you using for SSH access ? The HSRP log message indicates that there is a mismatch between the configured authentication parameters. Are you using the standby IP to access the switch ?

Also, make sure the modulus (1024 or 2048) match on both sides (the ASA and the 3850). Try 1024 first...

[Deepak Kumar]

It appears the client is setup to only accept advanced (Next Generation Encryption - NGE) cryptographic algorithms and the server offers a public key using the older RSA encryption method. the mismatch causes the attempted connection to fail.

Either the client needs to relax the requirements or a new public key need to be generated on the server.

Reference:

https://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/116055-technote-ios-crypto.html

And I am not sure about your IOS version. There is a bug reported for the same:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc96144/?referring_site=bugquickviewredir

My suggestion is that please regenerate the Key with 1024 bits.

Regards,

Deepak Kumar

[Mark_Zhang]

At first, thank you for your advice. Since the 3850 Switch is our Core Switch, and if we want to login other devices I must use 3850 Switch as the SSH Client (this is our company policy T_T), So I prefer to relax the requirements of SSH client(3850 Switch),  But I don't know how to configure it, cloud you please give me some hints? 

[Deepak Kumar]

conf t

hostname <hostname of device>

Your Switch configuration as below:

ip domain name <yourdomain.com example>

ip ssh version 2

ip ssh authen 3

ip ssh time 120

cryto key generate rsa <enter and type 1024 at least>

line vty 0 15

login local

transport input ssh

Transport output ssh <<edited>>

Make sure you have a local account for emergency recovery process and AAA configuration on Switch.

Regards,

Deepak Kumar

[Mark_Zhang]

Deepak:

thank you, I'll try it tomorrow.

[paul driver]

---

@Deepak Kumar wrote:

conf t

hostname <hostname of device>

Your Switch configuration as below:

ip domain name <yourdomain.com example>

ip ssh version 2

ip ssh authen 3

ip ssh time 120

cryto key generate rsa <enter and type 1024 at least>

line vty 0 15

login local

transport input ssh

Make sure you have a local account for emergency recovery process and AAA configuration on Switch.

Regards,

Deepak Kumar

---

Hello deepak

You allow outbound ssh connections from the switch it should br

Transport output ssh

Res

paul

[Deepak Kumar]

yah.. I missed.. Thanks for the update.

Regards,
Deepak Kumar

[Mark_Zhang]

It doesn't work for our situation

[paul driver]

Hello

Just like to add -

Worth checking to see if the switch is allowing | denying  ssh outbound 

sh run | be vty 

your should at least have 

Line vty xx

transport output ssh

res

paul

[Mark_Zhang]

I've tried it, but it doesn't work.

[Deepak Kumar]

Please attach the configuration and command output "Error" which you got during the configuration.

Regards,
Deepak Kumar

[Julio E. Moisa]

@Mark_Zhang

Are you able to ping the Switch management IP from the 3850? I assume you are using the same network segment to manage the devices. Also try to remove the key pair using the crypto key zeroize rsa from console and set the crypto key generate rsa, again. 

[Eric101]

From my understanding of your situation, you're currently unable to connect to the ASA via SSH from your 3850 switch, due to the SSH KEX errors.
As seen in your logs, the 3850 (client) is negotiating diffie-hellman-group-exchange-sha1 and the ASA (server) is sending diffie-hellman-group1-sha1 which are not the same.
Either the switch or the server are sending incorrect values.

I'd suggest modifying your ssh client ciphers on both the switch and the ASA to a matching supported value which would be a DH group14 KEX algorithm looking at my ASA running 9.6 and switch running 16.3.6

On the ASA
config t
ssh key-exchange-group dh-group14-sha1
end

On the 3850
conf t
ip ssh client algorithm kex diffie-hellman-group14-sha1
end

And ensure that the RSA key is at least 2048 bits long (longer is better) I would re-generate the keys on both sides to make sure.