Cisco Systems 3750E manual Configuring SSH, Limitations, Configuration Guidelines

Chapter 9 Configuring Switch-Based Authentication

Configuring the Switch for Secure Shell

SSH also supports these user authentication methods:

•TACACS+ (for more information, see the “Controlling Switch Access with TACACS+” section on page 9-10)

•RADIUS (for more information, see the “Controlling Switch Access with RADIUS” section on page 9-17)

•Local authentication and authorization (for more information, see the “Configuring the Switch for Local Authentication and Authorization” section on page 9-36)

Note This software release does not support IP Security (IPSec).

Limitations

These limitations apply to SSH:

•The switch supports Rivest, Shamir, and Adelman (RSA) authentication.

•SSH supports only the execution-shell application.

•The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data encryption software.

•The switch does not support the Advanced Encryption Standard (AES) symmetric encryption algorithm.

Configuring SSH

This section has this configuration information:

•Configuration Guidelines, page 9-39

•Setting Up the Switch to Run SSH, page 9-40(required)

•Configuring the SSH Server, page 9-41(required only if you are configuring the switch as an SSH server)

Configuration Guidelines

Follow these guidelines when configuring the switch as an SSH server or SSH client:

•An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.

•If the SSH server is running on a stack master and the stack master fails, the new stack master uses the RSA key pair generated by the previous stack master.

•If you get CLI error messages after entering the crypto key generate rsa global configuration command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then enter the crypto key generate rsa command. For more information, see the “Setting Up the Switch to Run SSH” section on page 9-40.

•When generating the RSA key pair, the message No host name specified might appear. If it does, you must configure a hostname by using the hostname global configuration command.

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

OL-9775-02 9-39