Limitations; Configuring Ssh; Configuration Guidelines - Cisco 2950 - Catalyst Switch Configuration Manual

Configuring the Switch for Secure Shell
SSH also supports these user authentication methods:
•
•
•
Note This software release does not support IP Security (IPSec).

Limitations

These limitations apply to SSH:
•
•
•
•

Configuring SSH

This section has this configuration information:
•
•
•
•

Configuration Guidelines

Follow these guidelines when configuring the switch as an SSH server or SSH client:
•
•
•
•
•
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
9-34
TACACS+ (for more information, see the
page 9-10)
RADIUS (for more information, see the
page 9-18)
Local authentication and authorization (for more information, see the
Local Authentication and Authorization" section on page
The switch supports Rivest, Shamir, and Adelman (RSA) authentication.
SSH supports only the execution-shell application.
The SSH server and the SSH client are supported only on DES (56-bit) and 3DES (168-bit) data
encryption software.
The switch does not support the Advanced Encryption Standard (AES) symmetric encryption
algorithm.
Configuration Guidelines, page 9-34
Cryptographic Software Image Guidelines, page 9-35
Setting Up the Switch to Run SSH, page 9-35
Configuring the SSH Server, page 9-36
server)
An RSA key pair generated by a SSHv1 server can be used by an SSHv2 server, and the reverse.
If you get CLI error messages after entering the crypto key generate rsa global configuration
command, an RSA key pair has not been generated. Reconfigure the host name and domain, and then
enter the crypto key generate rsa command. For more information, see the
to Run SSH" section on page
When generating the RSA key pair, the message "No host name specified" might appear. If it does,
you must configure a host name by using the hostname global configuration command.
When generating the RSA key pair, the message "No domain specified" might appear. If it does, you
must configure an IP domain name by using the ip domain-name global configuration command.
When configuring the local authentication and authorization authentication method, make sure that
AAA is disabled on the console.
Chapter 9
"Controlling Switch Access with TACACS+" section on
"Controlling Switch Access with RADIUS" section on
(required)
(required only if you are configuring the switch as an SSH
9-35.
Configuring Switch-Based Authentication
"Configuring the Switch for
9-32)
"Setting Up the Switch
78-11380-10