Cisco SSH key exchange is not performed from Ubuntu 14.04 (DH client key range mismatch)

Question

For some reason, I cannot use SSH on the Cisco CSR1000v router from an Ubuntu 14.04 machine.

Our firmware for Cisco:

Cisco IOS XE Software, Version 03.12.00.S - Standard Support Release Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2) 

Server error displayed:

 %SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server 

Client error displayed:

 $ ssh -v admin@172.16.3.253 OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to 172.16.3.253 [172.16.3.253] port 22. debug1: Connection established. debug1: identity file /home/admin/.ssh/id_rsa type 1 debug1: identity file /home/admin/.ssh/id_rsa-cert type -1 debug1: identity file /home/admin/.ssh/id_dsa type -1 debug1: identity file /home/admin/.ssh/id_dsa-cert type -1 debug1: identity file /home/admin/.ssh/id_ecdsa type -1 debug1: identity file /home/admin/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/admin/.ssh/id_ed25519 type -1 debug1: identity file /home/admin/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 debug1: Remote protocol version 2.0, remote software version Cisco-1.25 debug1: no match: Cisco-1.25 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-sha1 none debug1: kex: client->server aes128-ctr hmac-sha1 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP Connection closed by 172.16.3.253 

Answer 1

A workaround has been discovered, the trick is to use another KEX algorithm as such;

 $ ssh -v admin@172.16.3.253 -o KexAlgorithms=diffie-hellman-group14-sha1 

Cisco has a confirmed error report (see CSCuo76464 ) and has been discussed here .

There is also an error report for openssh-client .

Many thanks to jlgaddis for understanding this.

Answer 2

Or upgrade cisco ios. I had this problem and ios update does the trick

The error filed against the Cisco ssh client is CSCuo76464

https://tools.cisco.com/bugsearch/bug/CSCuo76464

Answer 3

(config) #ip ssh dh min size 4096