2

Trying to enable ssh on ASR-9K via vrf management interface. Doesn't seem as straight forward as regular IOS or NX-OS. Help appreciated.

#
RP/0/RSP0/CPU0:asr#show run
Tue Apr  4 21:54:55.407 UTC
Building configuration...
!! IOS XR Configuration 5.3.3
!! Last configuration change at Tue Apr  4 17:55:46 2017 by admin
!
hostname asr
domain name cislab.com
username su
 password 7 32221112255
!
vrf mgmt
!
line default
 transport input ssh
!
ipv4 access-list 10
 10 permit ipv4 any any
!
interface MgmtEth0/RSP0/CPU0/0
 vrf mgmt
 ipv4 address 10.7.0.38 255.255.255.0
!
interface MgmtEth0/RSP0/CPU0/1
 shutdown
!
interface GigabitEthernet0/0/0/0
 shutdown
!
interface GigabitEthernet0/0/0/1
 shutdown
!
interface TenGigE0/0/2/2
 shutdown
!
interface TenGigE0/0/2/3
 shutdown
!
router static
 vrf mgmt
  address-family ipv4 unicast
   0.0.0.0/0 10.7.0.1
  !
 !
!
ssh server vrf default
end
RP/0/RSP0/CPU0:asr#
#
RP/0/RSP0/CPU0:asr#show ssh sess de
Tue Apr  4 22:16:49.281 UTC
SSH version : Cisco-2.0 

id  key-exchange  pubkey  incipher  outcipher  inmac   outmac 
-------------------------------------------------------------------
Incoming Session 

Outgoing connection 
RP/0/RSP0/CPU0:asr#show log

RP/0/RSP0/CPU0:asr#show tcp br
Tue Apr  4 22:18:30.424 UTC
   PCB     VRF-ID     Recv-Q Send-Q Local Address          Foreign Address        State
0x50255d30 0x60000002      0      0  :::22                  :::0                   LISTEN
0x502554ac 0x00000000      0      0  :::22                  :::0                   LISTEN
0x50255b60 0x60000002      0      0  0.0.0.0:22             0.0.0.0:0              LISTEN
0x50195484 0x00000000      0      0  0.0.0.0:22             0.0.0.0:0              LISTEN
RP/0/RSP0/CPU0:asr#


RP/0/RSP0/CPU0:asr#show log | incl ssh
Tue Apr  4 22:18:53.668 UTC
RP/0/RSP0/CPU0:Apr  4 17:45:08.766 : SSHD_[65766]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss 
RP/0/RSP0/CPU0:Apr  4 17:46:41.377 : SSHD_[65857]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss 
RP/0/RSP0/CPU0:Apr  4 17:47:26.352 : SSHD_[65766]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss 
RP/0/RSP0/CPU0:asr#
  • Ary you trying to access ASR with SSHv1 from, as SSHv1 use dsa, and that is why key is not matching, try to use sshv2 in client and also please try to regenerate rsa key. – Sujeet Singh Apr 6 '17 at 17:29
3

You configured the SSH server to be active in the default vrf:

ssh server vrf default

So changing the vrf should help:

ssh server vrf mgmt

If that doesn't help, please consider adding more information to your question like debugging results and log messages. "Doesn't seem as straight forward" doesn't explain the exact problem you're running into very well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.