intermittent access issue to ssh vss switch 6500

[Network_Sarovani]

Hi Team , 

We have an issue accessing the VSS switch remotely via ssh , It works 1 or 2 times and does not work for 3rd time .. ( or works 1st time and 2nd time does not work ) 

How can we troubleshoot this issue , Cn we run any debug on the switch to find any abnormal logs . 

We are using CyberArk to connect via ssh to client Network device . 

Whenever it works , I get a popup first , I click on Yes and I get access to device . 

If the above pop up doesn't comes up then that is the time the screen will be blank as below : 

Regards , 

CK 

[balaji.bandi]

Looks you have old , configure below method based on the client and test it :

https://nbctcp.wordpress.com/2018/02/01/error-the-first-key-exchange-algorithm-supported-by-the-server-is-diffie-hellman-group1-sha1/

6500  - what is the IOS code running ?

[Network_Sarovani]

SOFTWARE VERSION  : 15.0(1)SY4, RELEASE SOFTWARE (fc3)

[balaji.bandi]

try reconfigure with higher secure as per the link suggested above post.

[Georg Pauwen]

Hello,

diffie-hellman-group1-sha1 is considered insecure, that is probably why Cyberark is showing that message.

Try to zeroize and regenerate the RSA key on the 6500s, and check if they support 2048 bit encryption:

crypto key zeroize rsa

crypto key generate rsa modulus 2048

[Network_Sarovani]

We are facing this problem only with 6500 VSS switch only . 

ssh works for below switch with model C3750G and probably having 1024 bit encryption and uses diffie-hellman-group1-sha1 .

Model : WS-C3750G-24PS

SWITCH_WORKING_ONE>show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 2
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDBl+UUWZXxWKp2SsNF90XQSluprhrUxQsVQ87c+TGy
euPFmTVkAZdmHibTghgR4zmX2cgLn94MkTcQEd0yUtvWzrJbdvQ/Vb4q5FbZhR4AQqegGE8vfeLm/Sv3
b1ZimOwaCq+sC/oj0XThHgfQbN81QsvTyAbSDLIMZjUsq+D1Vw==

[Network_Sarovani]

What will be the impact of doing this ? 

[balaji.bandi]

changing the ssh with higer encryption. not major effect - but good to do in maintenance window if you have concern. The version of code running you can change it.