Skip to content

SSH to 'old' Cisco

Issue

When SSH'ing old Cisco devices, you might get:

1
2
ssh locadm@ciscoswitch1
Unable to negotiate with ciscoswitch1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

This happens because your SSH client is more recent and disabled SHA-1 based key exchange algorithms by default, while the server only supports those older ones. Also, old ciphers are used by the Cisco device.

Solution

1
2
3
4
5
6
7
ssh \
  -oKexAlgorithms=+diffie-hellman-group14-sha1 \
  -oHostKeyAlgorithms=+ssh-rsa \
  -oPubkeyAcceptedAlgorithms=+ssh-rsa \
  -oCiphers=+aes256-cbc \
  -oMACs=+hmac-sha1-96 \
  localadm@ciscoswitch1

Or, to make it persistent for this host, in ~/.ssh/config:

1
2
3
4
5
6
Host ciscoswitch1
    KexAlgorithms +diffie-hellman-group14-sha1
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa
    Ciphers +aes256-cbc
    MACs +hmac-sha1-96

⚠️ Security note: aes*-cbc, ssh-rsa (SHA-1), and hmac-sha1-96 are deprecated and weak.

Better fix:

  • Add modern host keys: ed25519 (and optionally RSA with RSA-SHA2)
  • Enable modern KEX (curve25519-…, diffie-hellman-group-exchange-sha256)
  • Enable modern MACs (hmac-sha2-256/512) and AEAD cipher (chacha20-poly1305@openssh.com) or CTR AES.