Unable to SSH to Switch - no matching mac found: client hmac-sha1 server hmac-sha1-96 error

[CiscoBrownBelt]

So I am unable to ssh from one device to another. I am testing this way because right now I only have the devices connected to each other and I console into them. Anybody familiar with what is going on?

no matching mac found: client hmac-sha1 server hmac-sha1-96

[Georg Pauwen]

Hello,

your devices cannot agree on a common message authentication code (MAC). Which devices are those, and what IOS versions are you running ? Which rsa keys do you have configured ?

[CiscoBrownBelt]

These are 4431 Routers and configured for 2048.

[Reza Sharifi]

What is the output of "sh ip ssh"?

[CiscoBrownBelt]

SSH Enabled - version 2.0                                                              

Authentication methods:publickey,keyboard-interactive,password                         

Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa                             

Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa                                              

Encryption Algorithms:aes256-ctr                                                       

MAC Algorithms:hmac-sha1-96                                                            

Authentication timeout: 60 secs; Authentication retries: 3                             

Minimum expected Diffie Hellman key size : 1024 bits                                   

IOS Keys in SECSH format(ssh-rsa, base64 encoded): BB1_InterRt_4431_A.pmo.com          

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCWqleK7VQA+2Sl2cCFALBZJ4cm09Uh3N1dW+q4C4qo       

fbWXGcGzmiR1LuBHtakYlNrVqv2B3v0D1BgXbakK2zlJPXyyIgLD0iIJKHvcySDOdH6P4xJ8MWIRhd7m       

Eaqp80jd8PPxdrB4g/FMF+kFhVtobGKV4CFX2TE1yYCGndLNZw==

[Georg Pauwen]

Hello,

zeroize the keys and try a new key with 1024 modulus...

[CiscoBrownBelt]

Ok I will do that ASAP and let you know the status thanks so much!

[Reza Sharifi]

You may want to redo the SSH config.

Here is a link you can follow:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_01000.html

HTH

[davinci]

can you redo SSH config without locking yourself out?  which parts are you suggesting redoing?

[Ethan and Mia]

I had same issue after upgrade IOS-XE to some switchs

How you fix ? Thanks

[MarioGessa2087]

Hi Shat1478,

I've fixed it upgrading ssh client....in my case Putty from release 0.60 to release 0.74.

Ciao

Mario

[masouza95]

Hi,

It worked! Upgrading ssh client from release 0.60 to release 0.78.

Thanks

[educruzdb]

Hi,

Tnks, for your simple comments. Great solution