KB ID 0001322

Problem

I’ve lost count of the number of times this has happened to me! Most of my colleagues prefer to use the ASDM for remote management, but if (like me) you work at command line, then sometimes people <ahem> forget to generate the RSA keypair when deploying a firewall. Then even if SSH access and AAA is setup correctly, you still can’t get in via SSH. Instead you see the following;

Sep 05, 2019  RSA key pairs contain a key modulus value. The modulus determines the size of the RSA key. The larger the modulus, the more secure the RSA key. However, keys with large modulus values take longer to generate, and encryption and decryption operations take longer with larger keys. Crypto key generate rsa general-keys label tokenkey1 storage usbtoken0: The following example specifies the redundancy keyword: Router(config)# crypto key generate rsa label MYKEYS redundancy. The name for the keys will be: MYKEYS Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Mar 30, 2018  IKE is a key management protocol standard that is used in conjunction with the IPsec standard. IPsec is an IP security feature that provides robust authentication and encryption of IP packets. IPsec can be configured without IKE, but IKE enhances IPsec by providing additional features, flexibility, and ease of configuration for the IPsec standard. Jan 22, 2020 Symptom: To be able to SSH: a) We generate RSA keys first, however this fails with: ASR1K(config)#crypto key generate rsa modulus 2048 The name for the keys will be: asr1k.cisco.com% The key modulus size is 2048 bits% Generating 2048 bit RSA keys, keys will be non-exportable. Dec 26, 2013  so it looks as if there is no point in the 'crypto key generate rsa' command if i follow it up with the 'crypto key generate rsa usage-keys label sshkeys mod 1024' command, i just wanted to make sure the first wasn't need for the second to.

RoyalTS and RoyalTSX: ssh_exchange_identification: Connection closed by remote host.

PuTTY: PuTTY Fatal Error: Server unexpectedly closed network connection.

SecureCRT: Connection closed.

OSX/Linux: ssh_exchange_identification: Connection closed by remote host.

Now at command line you can fix this with a ‘Crypto Key Generate RSA Modulus 2048‘ command, but you can’t get to command line only ASDM.

Solution

On older versions of the ASDM you could generate the keypair in the Identification Certificates section (well you still can but only if you are also generating a certificate request file). So, as we are command line warriors, lets use the ASDM’s command line!

Tools > Command Line Interface > Multiple Line

Send > Wait a couple of minutes and try again.

REMEMBER: I’m assuming you have SSH setup correctly if not, see the following article;

Related Articles, References, Credits, or External Links

NA

SSH or Secure Shell is basically a secured method of accessing and sending commands to your router’s CLI through a network connection; without having to plug a console cable directly. Unlike standard telnet that sends data in plain-text format, SSH uses encryption that will ensure confidentiality and integrity of the data. There are two versions of SSH, where SSH v2 is an improvement from v1 due to security holes that are found in v1. By default if we Enable SSH in Cisco IOS Router it will support both versions.

Enable SSH in Cisco IOS Router

We can classify the process to into these 4 simple steps below:
1. Device preparation (setup hostname, domain name, username, and passwords)
2. Network preparation (IP addressing & routing)
3. Generate RSA key and activate SSH
4. Apply SSH transport for the vtys

The rest of this article will demonstrate the detailed configuration of each step mentioned above. Note that for first time configuration you will need to access your router directly using a console cable.

1. Device preparation

For the preparation step, you have to name your device and set the domain name. In this example we will use local database for credentials, so it is also mandatory to create at least one username and password for the router as SSH will not work without it. The example command to do it is as follows:

Generation zero key for vassholmens skytteklubb. In this example we created the two username (‘admin’ and ‘monitor’) with different level of privilege. This will be explained in the verification section later.

For now, that’s all we need to configure. In the next step we are going to configure the network.

2. Network preparation

Network configuration may vary depends on the network topology that you’re working with. In this example, we are going to use a simple topology where one interface of the router connected to a standard Cisco switch with a PC attached to it. Static IP configuration has been given to the PC with the router Fa0/1 IP address as the gateway. We also have a management IP assigned to the loopback interface on the router. Please refer to the diagram and configuration below:

Assuming that all cables connected properly, now we’re going to give IP address the router Fa0/1 and loopback interface with the configurations below:

In this example topology, routing configuration is not required and we should have no problem with the IP address reachability. But it’s always a good idea to verify everything, in this case we would check if we can ping to the PC from the router’s loopback interface.

Based on the output above ping from router’s loopback interface to PC is working and surely the opposite ping will work too. Therefore, we can conclude that the network configurations are all good, and we can move on to our main focus in this article which is the SSH configuration.

3. Generate RSA key and activate SSH

In this step we’re going to generate the RSA key that will be used by SSH to encrypt its data. You will need to specify the size of the key modulus. The higher the number, the stronger the encryption will become; but it will take more time to generate the key. In this example configuration below we’re using 1024 as the key modulus size, while the default size is 512.

After configuring as above, you will see a message similar to this: Generate crt and key from p12.

This message indicates that SSH has been activated on the router. To verify it we can issue the command show ip ssh on the router and the output will be something like this:

You may be wondering why SSH version 1.99 is shown on the output instead of version 1 or version 2. The answer for that is because by default Cisco supports both SSH v1 and v2. The number 1.99 is to indicate backward compatibility.

However, according to security best practice, it is highly recommended to disable SSH v1. To do that, we can simply issue command below to disable the v1 backward compatibility.

After that, let’s verify once again:

Okay, as you can see on the output above it says version 2.0 (I feel more secure now!) and that means we are done with this step. Let’s move on the last step.

4. Apply SSH transport for the vtys

We already have SSH activated in the previous step. Now we only have two things left to do: apply SSH on the virtual terminal line, and then set login authentication method to use local username we created in the device preparation step.

We will achieve this using the command as in example below:

The command line vty 0 4 is used to specify the maximum number of virtual terminal sessions allowed on the router. In this example, we are allowing maximum 5 sessions (from session number 0 to session number 4) on the router.

The command transport input ssh will apply SSH to the virtual terminal line and also disable other methods like telnet. So that means after applying this command, SSH is the only method you can use to access the router.

The command login local is used to authenticate any login attempt against local username database, and remember that we’ve created two local username before (refer to step 1).

Cisco Switch Generate Rsa Key

With this configuration, we’ve successfully Enable SSH on Cisco IOS Router.

Verification

We are now going to test accessing to our router using an SSH client software on the PC, in this example we’re using PuTTY. We specified the router loopback address 1.1.1.1 as the destination and SSH as the connection type.

We are then prompted to login, so we type username ‘admin’ and password ‘letmein123’ as we configured before (refer to step 1).

Great, we can now get in to the router CLI remotely using SSH! Remember that on step 1 we gave privilege level 15 to the username ‘admin’, therefore it can directly enter the privileged EXEC mode without an enable password (indicated by the ‘#’ sign next to the router hostname). What happens if we try to login using the ‘monitor’ username?

This username stays in the user EXEC mode (indicated by the ‘>’ sign next to the router hostname). On step 1, we didn’t assign any privilege level to this username therefore it is in default privilege level 1. It cannot do any configuration changes in user EXEC mode until it enters command enable and enter the password. Enable password is required for this to work, and that’s why we’ve configured it in step 1.

Managing the SSH session

Sometimes we would want to know who is currently logged in to our router. We can easily show the active users by issuing command show users on the router. The output will be something like this:

The output above shows that both username ‘admin’ and ‘monitor’ are currently logged in from the same IP address, since we only use one PC in this demonstration. However, you can see each one of them is having different session number. Username ‘admin’ has session number 0 and username ‘monitor’ has session number 1.

And if you notice, the asterisk (*) mark on the ‘admin’ username indicates that this command is executed from ‘admin’ session. You can disconnect any session from the privileged EXEC mode by issuing command clear line vty x where ‘x’ is the session number. In this example, we want to disconnect session from username ‘monitor’ and therefore we will use the command clear line vty 1. The output on ‘admin’ session will be like this:

We pressed enter key when asked for confirmation and got ‘OK’ as the result. With this command, we’ve successfully kicked out username ‘monitor’ from the SSH session, confirmed by the output from command below:

In this way you can enable SSH in Cisco IOS router.

Cisco Crypto Key Gen Rsa

Arranda Saputra

Generate Rsa Crypto Key Cisco

• Restore DHCP Server in Windows Server 2012 R2 - January 9, 2020
• Backup DHCP Server in Windows Server 2012 R2 - January 9, 2020
• Configure DHCP Reservation in Windows Server 2012 R2 - January 9, 2020