Configuring SSH for IPv6

By default, SSH is automatically enabled for IPv4 and IPv6 connections on a switch. Use the ip ssh command options to reconfigure the default SSH settings used in SSH authentication for IPv4 and IPv6 connections:

  • TCP port number

  • timeout period

  • file transfer

  • MAC type

  • cipher type

Syntax:

ip ssh

no ip ssh

Enables SSH for on the switch for both IPv4 and IPv6, and activates the connection with a configured SSH server (RADIUS or TACACS+). The no form of the command disables SSH on the switch.

[cipher <cipher–type>] : Specify a cipher type to use for connection. Valid types are:

  • aes128-cbc

  • 3des-cbc

  • aes192-cbc

  • aes256-cbc

  • rijndael-cbc@lysator.liu.se

  • aes128-ctr

  • aes192-ctr

  • aes256-ctr

Default: All cipher types are available.

Use the no form of the command to disable a cipher type.

[filetransfer] : Enables SSH on the switch to connect to an SCP or SFTP client application to transfer files to and from the switch over IPv4 or IPv6. Default: Disabled

NOTE:

Enabling filetransfer automatically disables TFTP client and TFTP server functionality.

[mac <MAC–type>] : Allows configuration of the set of MACs that can be selected. Valid types are:

  • hmac-md5

  • hmac-sha1

  • hmac-sha1-96

  • hmac-md5-96

Default: All MAC types are available.

Use the no form of the command to disable a MAC type.

[port <1–65535|default>] : TCP port number used for SSH sessions in IPv4 and IPv6 connections. Default: 22.

Valid port numbers are from 1 to 65535, except for port numbers 23, 49, 80, 280, 443, 1506, 1513, and 9999, which are reserved for other subsystems.

[public-key <manager|operator> keystring : Store a client-generated key for public-key authentication.

manager : Allows manager-level access using SSH public-key authentication.

operator : Allows operator-level access using SSH public-key authentication.

keystring : A legal SSHv2 (RSA or DSA) public key. The text string for the public key must be a single-quoted token. If the keystring contains double quotes, it can be quoted with single quotes ('keystring'). The following restrictions for a keystring apply:

  • A keystring cannot contain both single and double quotes.

  • A keystring cannot have extra characters, such as a blank space or a new line. (To improve readability, you can add a backlash at the end of each line.)

For more information on configuring and using SSH public keys to authenticate SSH clients connecting to the switch, see "configuring secure shell" in the latest ArubaOS-Switch Access Security Guide for your switch.

[timeout <5–120> : Time out value allowed to complete an SSH authentication and login on the switch. Default: 120 seconds.

[listen <data|both>] : The listen parameter applies to the Switch 2920-series only and is not available on switches that do not have a separate out-of-band management port. Values for this parameter are:
  • data

    inbound or outbound SSH access is enabled only on the data ports.

  • both

    inbound or outbound SSH access is enabled on both the out-of-band management port and on the data ports. This is the default value.

IMPORTANT:

The listen parameter applies to the 2920 switch series only and is not available on switches that do not have a separate out-of-band management port.

Example 

Switch# ip ssh ?
  cipher                              Specify a cipher to enable/disable.
  filetransfer                        Enable/disable secure file transfer capability.
  mac                                 Specify a mac to enable/disable.
  port                                Specify the TCP port on which the daemon should listen 
                                      for SSH connections.
  public-key                          Configure a client public-key.
  timeout                             Specify the maximum length of time (seconds) permitted 
                                      for protocol negotiation and authentication.
  <cr>
NOTE:

For both IPv4 and IPv6, the switch supports only SSH version 2. You cannot set up an SSH session with a client device running SSH version 1.

For more information on how to configure SSH for encrypted, authenticated transactions between the switch and SSH-enabled client devices, see the latest ArubaOS-Switch Access Security Guide for your switch.