Question

出于某种原因，我无法从Ubuntu 14.04计算机SSH连接到Cisco CSR1000v路由器。

我们的思科固件是;

Cisco IOS XE Software, Version 03.12.00.S - Standard Support Release
Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)

显示的服务器错误是;

%SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server

显示的客户端错误是;

$ ssh -v admin@172.16.3.253
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 172.16.3.253 [172.16.3.253] port 22.
debug1: Connection established.
debug1: identity file /home/admin/.ssh/id_rsa type 1
debug1: identity file /home/admin/.ssh/id_rsa-cert type -1
debug1: identity file /home/admin/.ssh/id_dsa type -1
debug1: identity file /home/admin/.ssh/id_dsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ecdsa type -1
debug1: identity file /home/admin/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/admin/.ssh/id_ed25519 type -1
debug1: identity file /home/admin/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<7680<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Connection closed by 172.16.3.253

Answer 1

找到一个解决方法，诀窍就是使用不同的KEX算法;

$ ssh -v admin@172.16.3.253 -o KexAlgorithms=diffie-hellman-group14-sha1

思科有一个确认的错误报告（见CSCuo76464），和讨论了here。

还有openssh-client的错误报告。

非常感谢jlgaddis解决这个问题。

Answer 2

升级cisco ios。我遇到了这个问题，ios升级就是这个伎俩

针对Cisco ssh客户端提交的错误是CSCuo76464

https://tools.cisco.com/bugsearch/bug/CSCuo76464

Answer 3

（config）#ip ssh dh min size 4096

来自Ubuntu 14.04的Cisco SSH密钥交换失败（客户端DH密钥范围不匹配）

3 个答案: