Contents

1. Generate Rsa Key Cisco Switch For Windows 7
2. Crypto Key Generate Rsa Command
3. Crypto Key Generate
4. Cisco Crypto Key Gen Rsa
5. Create Rsa Keys Cisco
6. Crypto Key Generate Rsa Modulus 1024 Cisco Switch

Introduction

This document gives step-by-step instructions to configure Secure Shell (SSH) Version 1 on Catalyst switches running Catalyst OS (CatOS). The version tested is cat6000-supk9.6-1-1c.bin.

Prerequisites

Requirements

This table shows the status of SSH support in the switches. Registered users can access these software images by visiting the Software Center.

How to create self-signed certificates An article by Fabio Semperboni Tutorial A digital certificate or identity certificate is an electronic document which uses a digital signature to bind a public key with an identity, information such as the name of a person or an organization, their address, and so forth. Jan 19, 2006  crypto key zeroize rsa crypto key generate rsa general-keys label (label) mod (modulus) exportable Do not use anonymous RSA keys (named after the FQDN of the switch). Use labeled keys instead. Crypto key generate rsa general-keys label (label) mod (modulus) exportable. Crypto key generate rsa - crypto key generate rsa general-keys modulus 2048 - crypto key generate rsa general-keys label SSH modulus 2048. None of the above worked.and the SSH key remains 1024. Does anyone know how to change the SSH Key for this switch from 1024 to 2048? Version is Version 12.2(50)SE4.

* Configuration is covered in Configuring Secure Shell on Routers and Switches Running Cisco IOS.

So it looks as if there is no point in the 'crypto key generate rsa' command if i follow it up with the 'crypto key generate rsa usage-keys label sshkeys mod 1024' command, i just wanted to make sure the first wasn't need for the second to work or something screwy like that. When you use the crypto key generate rsa command, it will ask you how many bits you want to use for the key size. How much should you pick? It’s best to check the next generation encryption article from Cisco for this. At this moment, a key size of 2048 bits is acceptable. Key sizes of. This article shows how to configure and setup SSH for remote management of Cisco IOS Routers.We’ll show you how to check if SSH is supported by your IOS version, how to enable it, generate an RSA key for your router and finally configure SSH as the preferred management protocol under the VTY interfaces. Secure Shell (SSH) provides a secure and reliable mean of connecting to remote devices.

Generate Rsa Key Cisco Switch For Windows 7

** There is no support for SSH in 12.1E train for Catalyst 4000 running Integrated Cisco IOS Software.

Refer to Encryption Software Export Distribution Authorization Form in order to apply for 3DES.

This document assumes that authentication works prior to implementation of SSH (through the Telnet password, TACACS+) or RADIUS. SSH with Kerberos is not supported prior to the implementation of SSH.

Components Used

This document addresses only the Catalyst 2948G, Catalyst 2980G, Catalyst 4000/4500 series, Catalyst 5000/5500 series, and Catalyst 6000/6500 series running the CatOS K9 image. For more details, refer to the Requirements section of this document.

The information presented in this document was created from devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If you are working in a live network, ensure that you understand the potential impact of any command before using it.

Conventions

For more information on document conventions, see the Cisco Technical Tips Conventions.

Network Diagram

Switch Configuration

Disabling SSH

In some situations it may be neccessary to disable SSH on the switch. You must verify whether SSH is configured on the switch and if so, disable it.

To verify if SSH has been configured on the switch, issue the show crypto key command. If the output displays the RSA key, then SSH has been configured and enabled on the switch. An example is shown here.

To remove the crypto key, issue the clear crypto key rsa command to disable SSH on the switch. An example is shown here.

debug in the Catalyst

To turn on debugs, issue the set trace ssh 4 command.

To turn off debugs, issue the set trace ssh 0 command.

Crypto Key Generate Rsa Command

debug Command Examples of a Good Connection

Solaris to Catalyst, Triple Data Encryption Standard (3DES), Telnet Password

Solaris

Catalyst

PC to Catalyst, 3DES, Telnet Password

Catalyst

Solaris to Catalyst, 3DES, Authentication, Authorization, and Accounting (AAA) Authentication

Solaris

Catalyst

debug Command Examples of What Can Go Wrong

Catalyst debug with Client Attempting [unsupported] Blowfish Cipher

Catalyst debug with Bad Telnet Password

Catalyst debug with Bad AAA Authentication

Troubleshoot

This section deals with different troubleshooting scenarios related to SSH configuration on Cisco switches.

Crypto Key Generate

Cannot Connect to Switch through SSH

Cisco Crypto Key Gen Rsa

Problem:

Cannot connect to the switch using SSH.

The debug ip ssh command shows this output:

Solution:

This problem occurs because of either of these reasons:

• New SSH connections fail after changing the hostname.

• SSH configured with non-labeled keys (having the router FQDN).

The workarounds for this problem are:

• If the hostname was changed and SSH is no longer working, then zeroize the new key and create another new key with the proper label.

• Do not use anonymous RSA keys (named after the FQDN of the switch). Use labeled keys instead.

In order to resolve this problem forever, upgrade the IOS software to any of the versions in which this problem is fixed.

Create Rsa Keys Cisco

A bug has been filed about this issue. For more information, refer to Cisco bug ID CSCtc41114 (registered customers only) . Pre-generate ssh host keys.

Crypto Key Generate Rsa Modulus 1024 Cisco Switch

Related Information