SSH from Powershell

[Moudar]

Hi

I have a few Catalyst 1000 switches running version 15.2(7)E11.

When trying to connect via PowerShell, I receive the following error:

Unable to negotiate with 172.22.8.13 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

The switch is running the latest version, and I’ve tested both available KEX algorithms, but the issue persists:

(config)#ip ssh server algorithm kex ?
  diffie-hellman-group-exchange-sha1  DH_GRPX_SHA1 diffie-hellman key exchange algorithm
  diffie-hellman-group14-sha1         DH_GRP14_SHA1 diffie-hellman key exchange algorithm

Why hasn’t Cisco updated the supported KEX algorithm list with more secure options?

[Flavio Miranda]

@Moudar 

 I think this message is related to the client ssh and not the server. 

Try to run this way

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 172.22.8.13

[Moudar]

That might work but, using the -o KexAlgorithms=diffie-hellman-group14-sha1 and -o HostKeyAlgorithms=+ssh-rsa options in PowerShell forces SSH to use older, less secure encryption and key exchange algorithms. So I wonder why we are using these less secure encryption and key exchange algorithms.

[Flavio Miranda]

Check If windows have update for SSH client. This can be version