01-04-2019 01:57 PM
I'm currently seeing the following log messages. only seen after ios-xr upgrade from 5.3.2 to 6.4.2. The session_rekey_count seems to be incrementing over time.
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 1
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 1
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 2
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 2
....
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 16
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 17
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 17
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 18
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 18
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 19
SSHD_[65942]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 2 , session_rekey_count = 19
SSHD_[65822]: %SECURITY-SSHD-6-INFO_REKEY : Server initiated time rekey for session 1 , session_rekey_count = 20
Solved! Go to Solution.
01-05-2019 04:53 AM
when you upgrade to 6.4.2 it includes a new feature of SSH server to comply with FIP standards
essentially the key will be refreshed after a certain period of time or after a certain # of bytes
https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-4/system-security/configuration/guide/b-system-security-cg-asr9000-64x/b-system-security-cg-asr9000-64x_chapter_01110.html https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r6-1/security/command/reference/b-syssec-cr-asr9k-61x/b-syssec-cr-asr9k-61x_chapter_01010.html#wp3363813337
ssh server rekey-time time in minutes
no ssh server rekey-time
rekey-time time in minutes |
Specifies the rekey-time interval in minutes. The range is between 30 to 1440 minutes.
|
ssh server rekey-volume data in megabytes
no ssh server rekey-volume
rekey-volume data in megabytes |
Specifies the volume-based rekey threshold in megabytes. The range is between 1024 to 4095 megabytes.
|
01-05-2019 04:53 AM
when you upgrade to 6.4.2 it includes a new feature of SSH server to comply with FIP standards
essentially the key will be refreshed after a certain period of time or after a certain # of bytes
https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k-r6-4/system-security/configuration/guide/b-system-security-cg-asr9000-64x/b-system-security-cg-asr9000-64x_chapter_01110.html https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r6-1/security/command/reference/b-syssec-cr-asr9k-61x/b-syssec-cr-asr9k-61x_chapter_01010.html#wp3363813337
ssh server rekey-time time in minutes
no ssh server rekey-time
rekey-time time in minutes |
Specifies the rekey-time interval in minutes. The range is between 30 to 1440 minutes.
|
ssh server rekey-volume data in megabytes
no ssh server rekey-volume
rekey-volume data in megabytes |
Specifies the volume-based rekey threshold in megabytes. The range is between 1024 to 4095 megabytes.
|
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide