SSH failed on 3750 switch

George Paraschivescu · ‎06-09-2017

Hi

When i'm trying to SSH to my 3750 switch i get the following error:

Unable to negotiate with 192.168.1.250 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

I tried to use the command ip ssh dh min size 4096, but my switch doesn't know it.

Here is the config on the cisco switch:

Current configuration : 2325 bytes

!

version 12.2

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Switch

!

boot-start-marker

boot-end-marker

!

enable secret 5 xxxxx

!

username admin privilege 15 secret 5 xxxxx

!

no aaa new-model

switch 4 provision ws-c3750-24p

system mtu routing 1500

ip domain-name zorf.local

!

crypto pki trustpoint TP-self-signed-483538176

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-483538176

revocation-check none

rsakeypair TP-self-signed-483538176

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

ip ssh version 2

!

interface FastEthernet4/0/1

!

interface FastEthernet4/0/2

switchport access vlan 10

switchport mode access

spanning-tree portfast

!

interface FastEthernet4/0/3

!

interface FastEthernet4/0/4

switchport access vlan 10

switchport mode access

spanning-tree portfast

!

interface FastEthernet4/0/5

!

interface FastEthernet4/0/6

!

interface FastEthernet4/0/7

!

interface FastEthernet4/0/8

!

interface FastEthernet4/0/9

!

interface FastEthernet4/0/10

!

interface FastEthernet4/0/11

!

interface FastEthernet4/0/12

switchport access vlan 10

switchport mode access

!

interface FastEthernet4/0/13

!

interface FastEthernet4/0/14

!

interface FastEthernet4/0/15

!

interface FastEthernet4/0/16

!

interface FastEthernet4/0/17

!

interface FastEthernet4/0/18

!

interface FastEthernet4/0/19

switchport mode access

switchport voice vlan 10

spanning-tree portfast

!

interface FastEthernet4/0/20

!

interface FastEthernet4/0/21

switchport mode access

switchport voice vlan 10

spanning-tree portfast

!

interface FastEthernet4/0/22

!

interface FastEthernet4/0/23

switchport mode access

switchport voice vlan 10

spanning-tree portfast

!

interface FastEthernet4/0/24

!

interface GigabitEthernet4/0/1

!

interface GigabitEthernet4/0/2

!

interface Vlan1

no ip address

!

interface Vlan10

ip address 192.168.1.250 255.255.255.0

!

ip default-gateway 192.168.1.1

ip classless

ip http server

ip http secure-server

!

ip sla enable reaction-alerts

!

line con 0

logging synchronous

line vty 0 4

password xxxxxxx

logging synchronous

login local

transport input all

line vty 5 15

login

!

end

Georg Pauwen · ‎06-09-2017

Hello,

try to zeroize and recreate the crypto key:

crypto key zeroize rsa

crypto key generate rsa modulus 2048

1024 is the default, so changing it to 2048 might help...

George Paraschivescu · ‎07-01-2017

Hi,

As you can see in the output below, the modulus command is not available.

Switch(config)#crypto key zer

Switch(config)#crypto key zeroize ?

rsa Remove RSA keys

<cr>

Switch(config)#crypto key zeroize rsa

% All RSA keys will be removed.

% All router certs issued using these keys will also be removed.

Do you really want to remove these keys? [yes/no]: yes

Switch(config)#crypto key gener

Switch(config)#crypto key generate rsa modu

Switch(config)#crypto key generate rsa modu?

% Unrecognized command

Switch(config)#crypto key generate rsa ?

general-keys Generate a general purpose RSA key pair for signing and

encryption

storage Provide a storage location

usage-keys Generate separate RSA key pairs for signing and encryption

<cr>

Switch(config)#crypto key generate rsa

So i used:

crypto key generate rsa general-keys modulus 2048

But the error is the same:

Unable to negotiate with 192.168.1.250 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

Erik T. · ‎02-16-2018

The solution i have come across so far is putting some additional parameters to the ssh client.

$ ssh -l <USERNAME> -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 <HOST>

andromeda · ‎05-01-2020

Could some of the experts here what is the solution to bring up the cisco switch to the modern KEX instead of using a workaround?

Thanks!