Limitations; Configuring Ssh; Configuration Guidelines; Setting Up The Switch To Run Ssh - Cisco Catalyst 2975 Software Configuration Manual

Chapter 9 Configuring Switch-Based Authentication

Limitations

These limitations apply to SSH:
•
•
•
•

Configuring SSH

This section has this configuration information:
•
•
•

Configuration Guidelines

Follow these guidelines when configuring the switch as an SSH server or SSH client:
•
•
•
•
•
•

Setting Up the Switch to Run SSH

Follow these steps to set up your switch to run SSH:
1.
2.
OL-19720-02
The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
SSH supports only the execution-shell application.
The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data
encryption software.
The switch supports the Advanced Encryption Standard (AES) encryption algorithm with a 128-bit
key, 192-bit key, or 256-bit key. However, symmetric cipher AES to encrypt the keys is not
supported.
Configuration Guidelines, page 9-43
Setting Up the Switch to Run SSH, page 9-43
Configuring the SSH Server, page 9-44
server)
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
If the SSH server is running on a stack master and the stack master fails, the new stack master uses
the RSA key pair generated by the previous stack master.
If you get CLI error messages after entering the crypto key generate rsa global configuration
command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then
enter the crypto key generate rsa command. For more information, see the
to Run SSH" section on page
When generating the RSA key pair, the message
you must configure a hostname by using the hostname global configuration command.
When generating the RSA key pair, the message
must configure an IP domain name by using the ip domain-name global configuration command.
When configuring the local authentication and authorization authentication method, make sure that
AAA is disabled on the console.
Download the cryptographic software image from Cisco.com. This step is required. For more
information, see the release notes for this release.
Configure a hostname and IP domain name for the switch. Follow this procedure only if you are
configuring the switch as an SSH server.
(required)
(required only if you are configuring the switch as an SSH
9-43.
No host name specified
No domain specified
Catalyst 2975 Switch Software Configuration Guide
Configuring the Switch for Secure Shell
"Setting Up the Switch
might appear. If it does,
might appear. If it does, you
9-43