I'm trying to connect from a Cisco 886VA to a Juniper EX2200 via SSH. The connection fails with the following messages on the Cisco:

*Jan 17 09:51:20.823: SSH2 CLIENT 0: Server has chosen 2056 -bit dh keys
*Jan 17 09:51:20.823: %SSH-3-INV_MOD: Invalid modulus length

Is there any way to make this work by changing some parameter on either the Juniper or Cisco device?

IOS Version: 15.2(4)M5

JunOS Version: 12.3R3.4

  • Are there any other solutions ? Using the 4096 setting has broken a tool to login and will require development as this is considered as a non standard setting. Thank You Graham
    – Graham
    Commented May 17, 2017 at 9:17

3 Answers 3


This is definitely an issue with your DH key size.

Try this:

cisco886va(config)#ip ssh dh min size 4096
  • Setting the dh min size to 4096 worked. 2048 was not enough. Thanks! Commented Jan 17, 2014 at 11:40
  • @Sebastian Now I wonder where 2056 comes from? That seems like a strange key size, but none-the-less, the most secure if it requires 4096 key sizes.
    – Ryan Foley
    Commented Jan 17, 2014 at 11:49
  • No idea, it is a standard juniper box with SSH enabled. Commented Jan 18, 2014 at 12:57

Junos's /etc/ssh/primes file had an off by 8 bug. That is, moduli in that file advertized to be 2048bits, were in fact 2056 bits long.

Cisco SSH client is very strict in this regard, and hence refuses to proceed. As a work around, delete /etc/ssh/primes file from your Junos device. This will cause Junos to use Group14 moduli.



you need to generate new rsa key on cisco and specify larger modulus for the key

  • This is the Diffie-Hellman parameter, not the modulus from the RSA key. We did create a 2048 bit RSA key on the Cisco. Commented Jan 17, 2014 at 10:05
  • may be, you should try to generate key with modulus-size 4096. this is worked for me, i`ve same error (%SSH-3-INV_MOD), but not with juniper. cisco.com/en/US/docs/ios-xml/ios/security/a1/…
    – pyatka
    Commented Jan 17, 2014 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.