Setup Passwordless SSH Connection From C9200 to OpenSSH Server

[matdan16]

Hi everyone,

I want to setup a passwordless SSH connection from cisco switch catalyst c9200 to openSSH server running on Windows Server 2019. I managed to setup this on cisco nexus9000 C93180YC-FX and use it for running schedule job to backup the running config to the openSSH server. I want to setup the same thing for the cisco c9200. I have tried few things but it still not working. Below are few details that might help

- I have remote SSH access to this c9200 (version 17.03.04b) switch login using TACACS account
- I have physical access to the switch
- I have access to the openSSH server
- I generated the key while login into the switch using TACACS account
- I have generated rsa key and use the signature key but still failed to connect without password
- Upon manual connection test, it still asked for password
- I checked on the OpenSSH server event viewer but there is no attempt from the c9200 switch to use key to make the SSH connection

Thank you.

[Jens Albrecht]

Hello @matdan16,

it is possible to connect to c9200 switches via SSH using a key instead of a password.

First, create the SSH key pair for the user <someusername> on the openSSH server and copy the public key without the ssh-rsa... header or comments.

Then prepare this user to authenticate using the key:

username <someusername> privilege 15
!
ip ssh pubkey-chain
  username <someusername>
    key-string
      <paste your public key>
      exit
    exit
  exit

Now this user can connect via SSH from your openSSH server to your switch without being asked for a password.

HTH!

[matdan16]

Hi @Jens Albrecht ,

Thank you for reply. Actually, I want to remote SSH the OpenSSH server from the Cisco C9200. But if this is not possible, then I have to use your method and run some script from the OpenSSH server to backup the running config of the C9200 switch.

Thank you.

[Jens Albrecht]

Hi @matdan16,

connecting via SSH from the c9200 switch to the openSSH server can only be done with password authentication. 
On IOS-XE the switch’s SSH client does not support key-based authentication.

Regards, Jens