Unable to SSH to a 3750 that was upgraded & redeployed.

[Mogwai]

Hello, I've recently redeployed a 3750 after attempting a firmware upgrade that was botched.  After the upgrade from 12.2 to 15.02, I can console to the switch & have reconfigured it so it's working as it was originally, except for SSH access. I've attempted to reconfigure the SSH a few times & since the firmware update it hasn't worked. I've attached the running configs of the same switch before & after the redployment for reference if it helps?  Thanks, in advance. 

[marce1000]

                         - You are leaving out some basics :
         >Unable to SSH => how does that translate in network technical terms ?
                                       Is there an authentication error or something else ?

       > a firmware upgrade that was botched => If the device is in an unknown or 'uncertain' state after an upgrade
                                                                         then for instance , use telnet for access | copy the running configuration
                                                                         to an external repository  | factory reset | install needed version if (still)
                                                                         applicable | restore configuration from the external repository to running config and
                                                                         save the running config to the startup configuration , 

 M.

[Mogwai]

The firmware upgrade was botched initially, then I factory reset the switch and did the upgrade again on the clean switch and then copied the original running config to the updated switch. 

As for the SSH, sometimes it would be an authentication error & other times SSH simply would not even enable. I did fine multiple conflicting guides on hos to configure SSH, so I'm not 100% sure what is the simplest method. The method I used:

IP ssh version 2

no IP domain-lookup

IP domain-name xxxx.org

crypto key generates rsa 2048

Then finally once I do 'show IP ssh" it doesn't show as enabled or running.

[marce1000]

          >.... other times SSH simply would not even enable
     - You need to be more specific on that , if are on a supporting trail

         For the rest , if there is an authentication error then check the logs on the switch immediately after.
        Also show the output of show ip ssh

M.

[Mogwai]

Here is the output from the console session I just had on the switch. I cleared the existing SSH config & went through setting it up again. 

CEN-IDF6-3750X#conf t
Enter configuration commands, one per line. End with CNTL/Z.
CEN-IDF6-3750X(config)#sh ip ssh
^
% Invalid input detected at '^' marker.

CEN-IDF6-3750X(config)#do sho ip ssh
SSH Disabled - version 2.0
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE
CEN-IDF6-3750X(config)#no ip domain-name cccsd.org
CEN-IDF6-3750X(config)#do show ip domain-name
CEN-IDF6-3750X(config)#crypto key zeroize rsa
% All keys will be removed.
% All router certs issued using these keys will also be removed.
Do you really want to remove these keys? [yes/no]: yes
CEN-IDF6-3750X(config)#
CEN-IDF6-3750X(config)#
CEN-IDF6-3750X(config)#
CEN-IDF6-3750X(config)#
CEN-IDF6-3750X(config)#
CEN-IDF6-3750X(config)#ip ssh version 2
Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
CEN-IDF6-3750X(config)#ip domain         w do wr
Building configuration...
[OK]
CEN-IDF6-3750X(config)#ip domiain-name cccsd.org
^
% Invalid input detected at '^' marker.

CEN-IDF6-3750X(config)#ip domiain-name cccsd.orgmiain-name cccsd.org 
CEN-IDF6-3750X(config)#crypto key generate rs  a 2048
^
% Invalid input detected at '^' marker.

CEN-IDF6-3750X(config)#crypto key generate rsa 2048                     ?
call Configure Crypto Call Admission Control
dynamic-map Specify a dynamic crypto map template
engine Enter a crypto engine configurable menu
gdoi Configure GDOI policy
identity Enter a crypto identity list
ikev2 Configure IKEv2 Options
ipsec Configure IPSEC policy
isakmp Configure ISAKMP policy
key Long term key operations
keyring Key ring commands
logging logging messages
map Enter a crypto map
mib Configure Crypto-related MIB Parameters
pki Public Key components
xauth X-Auth parameters

CEN-IDF6-3750X(config)#crypto key ?
decrypt Decrypt a keypair.
encrypt Encrypt a keypair.
export Export keys
generate Generate new keys
import Import keys
move Move keys
pubkey-chain Peer public key chain management
storage default storage location for keypairs
zeroize Remove keys

CEN-IDF6-3750X(config)#crypto key gener ?
ec Generate EC keys for ECDSA
rsa Generate RSA keys

CEN-IDF6-3750X(config)#crypto key gener rsa ?
encryption Generate a general purpose RSA key pair for signing and
encryption
exportable Allow the key to be exported
general-keys Generate a general purpose RSA key pair for signing and
encryption
label Provide a label
modulus Provide number of modulus bits on the command line
on create key on specified device.
redundancy Allow the key to be synced to high-availability peer
signature Generate a general purpose RSA key pair for signing and
encryption
storage Store key on specified device
usage-keys Generate separate RSA key pairs for signing and encryption
<cr>

CEN-IDF6-3750X(config)#crypto key gener rsa 2048
^
% Invalid input detected at '^' marker.

CEN-IDF6-3750X(config)#crypto key gener rsa 204848    1024
^
% Invalid input detected at '^' marker.

CEN-IDF6-3750X(config)#crypto key gener rsa 1024    modulus 2048
The name for the keys will be: CEN-IDF6-3750X.cccsd.org

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 25 seconds)

CEN-IDF6-3750X(config)#do show ip ssh
SSH Disabled - version 2.0
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE

[marce1000]

       >...CEN-IDF6-3750X(config)#crypto key gener rsa 204848    1024
             % Invalid input detected at '^' marker.

      The switch already tells you that the command is not accepted , try the full command without any
   abbreviations , 

 M.

[Mogwai]

Yes, towards the bottom of mt previous post I did use the command with the full syntax and it did take & generate, but the following 'show' command doesn't show anything. 

CEN-IDF6-3750X(config)#crypto key gener rsa 1024    modulus 2048
The name for the keys will be: CEN-IDF6-3750X.cccsd.org

% The key modulus size is 2048 bits
% Generating 2048 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 25 seconds)

CEN-IDF6-3750X(config)#do show ip ssh
SSH Disabled - version 2.0
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE

[Richard Burts]

It is surprising that after generating the keys that you get this output.

CEN-IDF6-3750X(config)#do show ip ssh
SSH Disabled - version 2.0

Would you post the output of show version?

[marce1000]

      >...I did use the command with the full syntax and it did take & generate
  - Have an attempt with only using :  crypto key generate rsa
     and nothing else , if it prompts for other parameters , then use those within the ranges as prompted , 

 M.

[Mogwai]

I did try that, it was in my previous post, it forced me to us the 'modulus [numerical value] parameter. 

[marce1000]

   - Well then just go on with that and show ip ssh   again  later on , 

 M.

[Mogwai]

This is will the output

CEN-IDF6-3750X(config)#do show ip ssh
SSH Disabled - version 2.0
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE

[marce1000]

  - Sorry but you have omitted the most important stuff ; that being the full trail when the command
    is used   crypto key generate rsa
    What is happening , what are you inputting , show everything.

 M.