SSH Config on Nexus Switch

Question

Having trouble configuring SSH on 2 Fiber Channel Switches (NX-OS). Any Cisco experts here that can help?

I am pretty new with Cisco and having trouble looking for documentation on SSH config for Nexus switches.

I do not understand how to apply the SSH keys on client/server..

Want to be able to SSH to switch from any network that can ping the switch.

Answer 1

This is the documentation for the basic setup: https://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_1/Cisco_Nexus_5000_Series_Switch_CLI_Software_Configuration_Guide_chapter20.html

That is for a very old version so there may be some changes in newer releases of the NXOS software but the basic commands should be pretty much the same.

You may need to set a hostname for the switch and then enable the SSH feature set. The switch may come with a default key already setup but if not, you need to have it generate a key for it to use to start the SSH service:

switch# configure terminal
switch(config)# hostname switch1
switch1(config)# feature ssh
switch1(config)# ssh key rsa 2048
switch1(config)# exit

Once those are done, you should be able to access the switch via SSH. You may also need to create user accounts for additional users outside of the admin user account.

You can also create keys associated with new user accounts, that is covered in the documentation I linked.

Depending on the model of switch you have, you may be using a Management network interface for management access to the switch. You will need to make sure the Management network interface is configured for the proper IP address settings and default route in order to make it reachable from your networks.

If you are using the Management network interface, this page has a nice, concise guide on the setup of the Management interface for a basic network design:

https://humairahmed.com/blog/?p=6337

Take a look there and see if it matches your expectations.

If you want to use Layer-3 Switch Virtual Interfaces (SVI) on the switch, you will need to enable the feature set for that:

switch# configure terminal
switch1(config)# feature interface-vlan
switch1(config)# exit

And then create and configure desired VLANs and VLAN Interfaces:

switch# configure terminal
switch1(config)# vlan 500
switch1(config)# interface vlan 500
switch1(config)# ip address 10.10.10.1/24
switch1(config)# no shutdown
switch1(config)# exit

That is an example for a VLAN number 500 and associated Layer-3 interface with IP address configuration. You would have to use that VLAN on some switch interface to connect devices that need access to that network. By default, those devices (once online) will be able to connect via SSH to the IP address of the VLAN Interface (10.10.10.1). To block access via SSH to the switch SVI IP addresses, you would need to create access lists that block or restrict traffic to port 22 destined to the switch IP addresses.