Tell me more ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.
up vote 7 down vote favorite

You issue the command ssh 192.168.97.97 from a IOS device and the destination IOS router/switch SSH server is accepting both SSH versions. Being that you did not specify a version to use on the SSH client, which version of SSH will be used to connect to the IOS SSH server?

share|improve this question

1 Answer

up vote 10 down vote accepted

ssh version 2 for IOS 12.1(19)E and later

SSH from one switch to another... for reasons I can't explain, Cisco calls SSHv2 SSH-1.99...

SRV1#debug ip ssh client
SSH Client debugging is on
SRV1#ssh 10.19.1.2

Password:
Jun  4 13:45:28.747 CDT: SSH1: sent protocol version id SSH-1.99-Cisco-1.25   <-----
Jun  4 13:45:28.787 CDT: SSH CLIENT0: protocol version id is - SSH-1.99-Cisco-1.25
Jun  4 13:45:28.787 CDT: SSH CLIENT0: sent protocol version id SSH-1.99-Cisco-1.25

Also from linux when connecting to IOS...

[mpenning@something ~]$ ssh -v dst1
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to dst1 [10.19.1.1] port 22.
debug1: Connection established.
debug1: identity file /home/mpenning/.ssh/identity type -1
debug1: identity file /home/mpenning/.ssh/id_rsa type 1
debug1: identity file /home/mpenning/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version Cisco-1.25     <-------
debug1: no match: Cisco-1.25
debug1: Enabling compatibility mode for protocol 2.0                         <--------
debug1: Local version string SSH-2.0-OpenSSH_5.3
share|improve this answer
 
It's not clear that this answer addresses the IOS client default, since you demonstrate a non-IOS client. –  neirbowj Jun 4 at 18:34
 
Well-behaved SSH clients should use v2 by default and then fallback to v1 if v2 isn't available from the server or the client. I suppose it's a safe assumption that if you're initiating sessions from any device running 12.1(19)E and newer, to any device running 12.1(19)E and newer, SSHv2 should be used. –  John Jensen Jun 4 at 18:37
 
You can also force ssh with 'ip ssh version 2'. Then if OpenSSH client tries to connect (ssh -1 IOS_node) to it on sshv1 it'll get complaint 'Protocol major versions differ: 1 vs. 2' and will exit with return value 255 –  ytti Jun 4 at 19:00
 
@neirbowj, edited to correct... it's still using SSHv2 –  Mike Pennington♦ Jun 4 at 19:00
4  
FYI - version 1.99 is defined in RFC4253. It's just a flag that signals compatibility with old SSH protocol versions. –  John Jensen Jun 4 at 19:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.