Deploying ssh login on a router already running an IPSec tunnel

[Jim Blake]

I have a bunch of routers which were deployed (by someone else!) with IPsec tunnels over the Internet back to the core network, but with telnet vty access. This has got to be updated so that only ssh is available for vty use.

Its easy enough to deploy ssh, but part of the task involves generating a crypto key, "crypto key generate rsa" etc. if I try to do the configuration without this command, I get an error message asking me to do it.

And there is the problem: when I generate a key, it somehow screws the existing IPsec tunnel. Worse yet, it doesn't do it immediately, it waits an indeterminate length of time, probably (I guess) until after the IPsec tunnel has been inactive for a period and stopped/started, so what I *think* is happening is that on re-initiation of the tunnel, it picks up the wrong key and the other end kills the link. The logs have nothing relevant in them, and I'm still trying to have the failure occur on a router that's running debug.

Has anyone tried to do this upgrade before? do we have to put ssh on first and then rebuild the IPsec tunnel config?

Thanks for any thoughts/comments

Jim

[ghostinthenet · Accepted solution]

If the IPSec VPN is using certificate authentication, regenerating RSA keys can be bad. Without knowing more about your IPSec configuration, I would say that the best approach would be to generate a key for SSH that will not interfere with it. Try something like this:

crypto key generate rsa modulus 2048 label RSA_Key_SSH
ip ssh rsa keypair-name RSA_Key_SSH

This will generate a new key that is independent of any existing keys and configure SSH to use it.

[Jim Blake]

Thanks for the tip, Jody, I'll deploy your suggestion and get back to you with results...may be a day or so, problems can take time to evidence themselves, but I will get back. Also Thanks, Karsten, that's a useful document!

[Jim Blake]

Deployed your solution and it worked perfectly! Thanks again Jody!

[Karsten Iwen]

Jody already told you the way how you can avoid problems. And for the rest of the SSH-config you can look at the following document: Guide to better SSH-Security