I am trying to login ASR9001 router using ssh public key authentication. I tried to import my ssh public key to the router but no success.

RP/0/RSP0/CPU0:ASR9K-1#crypto key import authentication rsa disk0:/test.pem
Cannot execute the command : Invalid argument

Does any one know how to do that?


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Jan 4, 2021 at 22:34

3 Answers 3


I got response from Cisco Tech support and there are a few things not correctly described in the manual.

First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key).
Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program.

SSH Key Generation

ssh-keygen -b 1024 -t rsa -f myrouter_sshkey

This will generate myrouter_sshkey and myrouter_sshkey.pub. When you look into the public key file, it looks like followings:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDR/ggtknqBZ50pIAyzw0E93wfu2EsGLnft/uF6N4ov6Dsp1H7yoC5ssE+yOcrWHeDEQnD0BsNCLZPW+ye7jjYeE+CUrOINpi04PtD+zx95knpAFnREMV7w8fJ9c7/SMb2L4Jk6KlmTcqtM+lUgrxEnCD7Z1kpCUzkP+0D0N/RG2Q== [email protected]

We only need the second part of the public key file separated by space for base64 decoding.

'de'code SSH public key with base64.

cut -d" " -f2 myrouter_sshkey.pub | base64 -d > myrouter_sshkey.pub.b64

This generated file is binary format and can be imported to ASR router.
Note that if you're using MAC, use -D option instead.

Upload 'de'coded public key to the router.

RP/0/RSP0/CPU0:ASR9K#copy ftp:myrouter_sshkey.pub.b64 harddisk:/

I used ftp but you can use tftp or else.

import public key to a router user.

RP/0/RSP0/CPU0:ASR9K(admin)#crypto key import authentication rsa username admin

Verify key import

RP/0/RSP0/CPU0:ASR9K(admin)#sh crypto key authentication rsa all    
Key label: admin
Type     : RSA public key authentication
Size     : 1024
Imported : 18:39:54 UTC Thu Jul 03 2014
Data     :
 {{intentionally removed}}

Login test

ssh -oIdentitiesOnly=yes -i myrouter_sshkey ${myrouter}

Note that if you have more than one ssh keys, -oIdentitiesOnly=yes must be given or your connection will fail. SSH tries every keys sequentially until one of the keys is accepted or finally falls back to password authentication if applicable. SSH server may allow this multiple key trials even if the first key trial fails. Unfortunately ASR router seems not to allow this. If the first tried key fails, it disconnect the session. To explicitly specify the key you use, give -oIdentitiesOnly=yes option to ssh.

ip ssh pubkey-chain
  username ...

IOS-XR on the ASR9k appears to be poorly documented on the subject (other than saying it supports it.) crypto key import authentication rsa general-keys would appear to be the command, but there's no example of using it to import a user key, vs. the router's own identity.

  • Where should I enter above commands? both enable and configure mode does not recognize them. Commented Jun 19, 2014 at 6:19
  • configuration mode (config t)
    – Ricky
    Commented Jun 19, 2014 at 6:22
  • I'm afraid IOS-XR doesn't understand above commands. RP/0/RSP0/CPU0:ASR9K-1(config)#ip ? ^ % Invalid input detected at '^' marker. Commented Jun 19, 2014 at 6:25
  • These config lines are for IOS and not relevant for IOS-XR
    – Cougar
    Commented Apr 11, 2015 at 19:40

Minsuk Song instructions worked, however some of the steps were not clear to me. Couple things I would like to clarify.

Re: "Upload 'de'coded public key to the router." section. The example does not share the exact syntax to pull the key from a remote system. Also note, you need to run an FTP server. For windows you can use Filezilla, for Linux I use the python library pyftpdlib (you can pip install the module) then run

sudo python -m pyftpdlib -p 21 -w

The actual syntax to pull from a remote server would be

copy ftp://@ harddisk:/

The Cisco will then prompt you for login info.

Re: "import public key to a router user." I did not need to type "admin" (I am running Cisco IOS XR 7.4.15). The syntax I used was the following:

crypto key import authentication rsa username yourusernameonthecisco ftp://@

Everything else worked fine.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.