SSH issues on C9500-48Y4C running Gibraltar 16.12.03a

[saba1418]

I recently unboxed and partially configured two C9500-48Y4C's, which I upgraded to Gibraltar 16.12.03a. I am unable to find the right documentation on correctly configuring SSH to work properly, after using configurations that have worked on other models in the past, which are not working properly on this model. I am wondering if anyone knows A.) where the proper configuration guides are located, and B.) if anyone has any first hand knowledge/information they would like to share regarding this topic. On most Cisco products there are but a few commands needed to allow for SSH to work and be functional, which is obviously no longer the case, or I am missing one or more steps in the process. Any help would be greatly appreciated, and I thank you in advance for your time and expertise. Thank you Madams and Sirs.

[balaji.bandi]

Cat 9500 like any other Catalyst mode configuration, nothing special other than some SVL and other stuff. otherwise, personally i do not see any difference.

you can refer below guide to configure :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-2/configuration_guide/sec/b_172_sec_9300_cg/configuring_secure_shell_version_2_support.html

If you have any specific question happy to help you, install some Cat 9500 / Many 9300 and 9200

[saba1418]

These are the commands I have input on the configuration:

line vty 0 4
exec-timeout 3 0
transport input ssh
line vty 5 15
exec-timeout 3 0
transport input ssh
!
crypto key generate rsa general-keys modulus 2048
!
ip ssh version 2

Have you successfully configured SSH using only those commands in the past? 

[Richard Burts]

As a next step in investigating this issue would you post the output of show ip ssh

[balaji.bandi]

it should work  as expected, if not - can you post-show ip ssh and also tell us what is wrong when are you connecting using SSH from a client like putty or secure CRT?

Also, post-show version from your device.

[saba1418]

I will check on it now, and reply directly...

[saba1418]

CORE#show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96
KEX Algorithms:diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 2048 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): TP-self-signed-3661210606
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCGiDWHs4J/mPCPtO/KGWufTlvJzFo+BWBomWOplBz8

o3bNabAkW6CcVwdmdvsPkGI216yCLBfJNyHbU/Efjt9gmDjDbNhq5pSnvFLGx4ArhMugheBmJjN5VvrW

A3grdF92ZNaWHdkWwyvXnjYoCets/9DS533oNG2eNkto2r1DiRjin0zD7QnSFTPkPowvUjIqdU8HEchi

WgN4C2HCwJO3ZtPGyLor6JAElFJlVfZsE2OoG1MphBUt21oxYeYvdjI0omSfkM41zlt9PPOW4sHERbET

xdORxSxX+tuuz9W2Z6vMXgQtXC/flmR27Mkxm6e1vnBJvkIm8A7lweGmeGtj

[Richard Burts]

Thank you for the output of show ip ssh. It shows clearly that ssh is enabled. So if it is not working we need to look for other causes of the problem. Can you tell us what device you are using to initiate ssh to the 9500? Can you tell us what happens when you attempt ssh connection to 9500? Do you get any prompt? Do you get any response message? Or does it just hang?

The next things that I would want to check as potential causes of the problem would be 1) connectivity issues or 2) authentication issues. So can you verify IP connectivity between the ssh source machine to the IP address on the 9500? (and can you verify that the address you are using is an address on the 9500?) Can your source device ping the destination address? Then can you tell us how you have configured authentication on the 9500? I would assume that it is using local authentication, but want to be sure. And if it is local authentication can you verify that the user name used for ssh is correctly configured on the 9500 with the password that you are using for ssh attempt?

If neither of these seem to be a problem then we might want to see more of the configuration. And it might be good to enable debug for ssh, attempt ssh access, and post any debug output.

[saba1418]

I can ping between the 9500 and other network devices that are on the same vlan. When I attempt to SSH between my work laptop, which has putty installed and is functional when attempting SSH sessions with other network devices on the same vlan the session just hangs, I get no message or prompt of any kind. 

my authentication settings are:

aaa authentication login default group radius local
aaa authentication login console local
aaa authentication dot1x default group radius

I have the same auth settings on all my 9300's and have never had an issue.

Thank you for your help, I appreciate it...

[Richard Burts]

Thank you for the information. If you get no response it seems somewhat less likely to be an authentication issue. But to be sure can you verify that the user name associated with the ssh session for putty is configured as a local user on the 9500?

Is putty attempting ssh using an IP address or a name? Can you verify that your work laptop can ping that destination?

[balaji.bandi]

thank you for the information - can you post show version also.

what is the issue ? what error you getting ?  have you configured users / aaa configuration ?

[saba1418]

CORE#show ver
Cisco IOS XE Software, Version 16.12.03a
Cisco IOS Software [Gibraltar], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.12.3a, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2020 by Cisco Systems, Inc.
Compiled Tue 28-Apr-20 09:37 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2020 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON
BOOTLDR: System Bootstrap, Version 17.1.1[FC2], RELEASE SOFTWARE (P)

CORE uptime is 3 days, 3 hours, 42 minutes
Uptime for this control processor is 3 days, 3 hours, 47 minutes
System returned to ROM by Reload Command at 10:23:36 extende Tue Sep 1 2020
System image file is "bootflash:packages.conf"
Last reload reason: Reload Command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Technology Package License Information:

------------------------------------------------------------------------------
Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------------------
network-advantage Smart License network-advantage
dna-advantage Subscription Smart License dna-advantage
AIR License Level: AIR DNA Advantage
Next reload AIR license Level: AIR DNA Advantage

Smart Licensing Status: UNREGISTERED/EVAL MODE

cisco C9500-48Y4C (X86) processor with 1867991K/6147K bytes of memory.
Processor board ID CAT2429L57L
9 Virtual Ethernet interfaces
96 TwentyFive Gigabit Ethernet interfaces
8 Hundred Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
16010152K bytes of physical memory.
11161600K bytes of Bootflash at bootflash:.
11161600K bytes of Bootflash at bootflash-2:.
1638400K bytes of Crash Files at crashinfo:.
1638400K bytes of Crash Files at crashinfo-2:.
0K bytes of WebUI ODM Files at webui:.

Base Ethernet MAC Address : 64:3a:ea:c6:43:80
Motherboard Assembly Number : 4873
Motherboard Serial Number : CAT2429L57L
Model Revision Number : V02
Motherboard Revision Number : 4
Model Number : C9500-48Y4C
System Serial Number : CAT2429L57L

Switch 02
---------
Base Ethernet MAC Address : 64:3a:ea:aa:da:a0
Motherboard Assembly Number : 4873
Motherboard Serial Number : CAT2430L0AJ
Model Revision Number : V02
Motherboard Revision Number : 4
Model Number : C9500-48Y4C
System Serial Number : CAT2430L0AJ

Configuration register is 0x102