I am trying to login ASR9001 router using ssh public key authentication. I tried to import my ssh public key to the router but no success.

RP/0/RSP0/CPU0:ASR9K-1#crypto key import authentication rsa disk0:/test.pem
Cannot execute the command : Invalid argument

Does any one know how to do that?


  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 21:21

I got response from Cisco Tech support and there are a few things not correctly described in the manual.

First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key).
Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program.

SSH Key Generation

ssh-keygen -b 1024 -t rsa -f myrouter_sshkey

This will generate myrouter_sshkey and myrouter_sshkey.pub. When you look into the public key file, it looks like followings:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDR/ggtknqBZ50pIAyzw0E93wfu2EsGLnft/uF6N4ov6Dsp1H7yoC5ssE+yOcrWHeDEQnD0BsNCLZPW+ye7jjYeE+CUrOINpi04PtD+zx95knpAFnREMV7w8fJ9c7/SMb2L4Jk6KlmTcqtM+lUgrxEnCD7Z1kpCUzkP+0D0N/RG2Q== foo@bar.com

We only need the second part of the public key file separated by space for base64 decoding.

'de'code SSH public key with base64.

cut -d" " -f2 myrouter_sshkey.pub | base64 -d > myrouter_sshkey.pub.b64

This generated file is binary format and can be imported to ASR router.
Note that if you're using MAC, use -D option instead.

Upload 'de'coded public key to the router.

RP/0/RSP0/CPU0:ASR9K#copy ftp:myrouter_sshkey.pub.b64 harddisk:/

I used ftp but you can use tftp or else.

import public key to a router user.

RP/0/RSP0/CPU0:ASR9K(admin)#crypto key import authentication rsa username admin

Verify key import

RP/0/RSP0/CPU0:ASR9K(admin)#sh crypto key authentication rsa all    
Key label: admin
Type     : RSA public key authentication
Size     : 1024
Imported : 18:39:54 UTC Thu Jul 03 2014
Data     :
 {{intentionally removed}}

Login test

ssh -oIdentitiesOnly=yes -i myrouter_sshkey ${myrouter}

Note that if you have more than one ssh keys, -oIdentitiesOnly=yes must be given or your connection will fail. SSH tries every keys sequentially until one of the keys is accepted or finally falls back to password authentication if applicable. SSH server may allow this multiple key trials even if the first key trial fails. Unfortunately ASR router seems not to allow this. If the first tried key fails, it disconnect the session. To explicitly specify the key you use, give -oIdentitiesOnly=yes option to ssh.

| improve this answer | |
ip ssh pubkey-chain
  username ...

IOS-XR on the ASR9k appears to be poorly documented on the subject (other than saying it supports it.) crypto key import authentication rsa general-keys would appear to be the command, but there's no example of using it to import a user key, vs. the router's own identity.

| improve this answer | |
  • Where should I enter above commands? both enable and configure mode does not recognize them. – Minsuk Song Jun 19 '14 at 6:19
  • configuration mode (config t) – Ricky Beam Jun 19 '14 at 6:22
  • I'm afraid IOS-XR doesn't understand above commands. RP/0/RSP0/CPU0:ASR9K-1(config)#ip ? ^ % Invalid input detected at '^' marker. – Minsuk Song Jun 19 '14 at 6:25
  • These config lines are for IOS and not relevant for IOS-XR – Cougar Apr 11 '15 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.