SSH not working 3650 IOS-XE 3.7.4E

[packetlove]

Hello Everyone,

I can't ssh into Cisco 3650 running on 3.7.4E. I generated new crypto keys rsa 2048 bits. But I am not able to tell if the switch is using old legacy keys or newly generated keys for rsa.  i see these below RSA keys that was generated like 5 years ago. The switch has not been rebooted since then. I am thinking to reboot this device to see if it helps. anyone has any thoughts ? 

RSA KEYS:

CISCO_IDEVID_SUDI_LEGACY, CISCO_IDEVID_SUDI, CISCO_IDEVID_SUDI_LEGACY.server, and newly generated crypto key with device hostname

Output:

show run | i ssh
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
ip ssh dh min size 2048
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
transport input telnet ssh

Please help! Thanks in advance

[Reza Sharifi]

Hi,

If you can't access it via SSH, you may want to add the below commands and try again:

transport preferred ssh
transport input ssh
transport output ssh

Also, make sure the IOS you are running does actually support SSH.

HTH

[packetlove]

Hi Reza,

This is what is configured in the switch currently. Telnet is working but not the SSH.

!

line con 0
logging synchronous
stopbits 1
line aux 0
stopbits 1
line vty 0 4
session-timeout 20
exec-timeout 30 0
login local
transport input telnet ssh
line vty 5 15
no login
transport input none
!

[Reza Sharifi]

add 

"transport input telnet ssh" to vty 5 15 as well

to 

line vty 5 15
no login
transport input telnet ssh

Also, does the ios support ssh? The image needs to have "K9" in it in order to support SSH.

HTH

[packetlove]

Yes it does support SSH. it has K9. 

[balaji.bandi]

Do you mean to say has this SSH worked before or never worked at all.

post below output :

show version

show IP ssh

[packetlove]

show ver
Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.07.04E RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Thu 19-May-16 11:48 by prod_rel_team

Cisco IOS-XE software, Copyright (c) 2005-2015 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0.
(http://www.gnu.org/licenses/gpl-2.0.html) For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON
BOOTLDR: CAT3K_CAA Boot Loader (CAT3K_CAA-HBOOT-M) Version 3.56, RELEASE SOFTWARE (P)

ntuldf-d1y038-asw351 uptime is 5 years, 3 weeks, 6 days, 54 minutes
Uptime for this control processor is 5 years, 3 weeks, 6 days, 58 minutes
System returned to ROM by Power Failure
System restarted at 20:00:27 GMT Fri Mar 17 2017
System image file is "flash:packages.conf"
Last reload reason: Power Failure

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

License Level: Lanbase
License Type: Permanent
Next reload license Level: Lanbase

cisco WS-C3650-48TD (MIPS) processor with 4194304K bytes of physical memory.
Processor board ID FDO2041Q095
2 Virtual Ethernet interfaces
50 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
250456K bytes of Crash Files at crashinfo:.
1609272K bytes of Flash at flash:.
0K bytes of Dummy USB Flash at usbflash0:.
0K bytes of at webui:.

Base Ethernet MAC Address : a0:3d:6f:df:6c:80
Motherboard Assembly Number : 73-15896-05
Motherboard Serial Number : FDO20410N4E
Model Revision Number : N0
Motherboard Revision Number : A0
Model Number : WS-C3650-48TD
System Serial Number : FDO2041Q095

Switch Ports Model SW Version SW Image Mode
------ ----- ----- ---------- ---------- ----
* 1 52 WS-C3650-48TD 03.07.04E cat3k_caa-universalk9 INSTALL

===========================

show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 60 secs; Authentication retries: 2
Minimum expected Diffie Hellman key size : 2048 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa asdfs.................

[balaji.bandi]

i suspect you have - License Level: Lanbase  ( but you have k9 image should work i guess here)

post show IP ssh (full output)

like below :

WAN-DMZ#show ip ssh
SSH Enabled - version 2.0
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr
MAC Algorithms:hmac-sha1,hmac-sha1-96
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): WAN-DMZ.bb.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDx/GpxEASqcKatGzgFPPMz7QzltzLUehQVuM0aDL9p
sN+y8xvwEedWclEukjptRYiXTL+93gWpg7eZgMGiefl6l4j9O5tKoBnuI65zlfYKvBTIiysQ8M+GpKiS
xRltqym6YxAs9klFSkLWCj4xNRdezFbHmdsiIp41AHDtnF2y+w==

[Leo Laohoo]

---

@packetlove wrote:

uptime is 5 years, 3 weeks, 6 days, 54 minutes

---

[Off Topic]  Hot dang!  5 years uptime!  With compliments (no, I am not being sarcastic).  On 3.7.X!

Good job and good choice of firmware version!