Field Notice: FN74246 - Cisco BroadWorks, Secure Shell (SSH) Clients, and Secure File Transfer Protocol (SFTP) Clients Will Fail to Connect to SSH Servers After Upgrade - Software Upgrade Recommended

When upgrading Cisco BroadWorks servers to releases RI2024.01 to 2024.12, some clients fail to connect to SSH servers if they are configured to use diffie-hellman-group-exchange-sha1 or diffie-hellman-group-exchange-sha256 key exchange algorithms with a diffie-hellman key size that is not a multiple of 64.

This affects the following groups of clients:

• SFTP clients that are used to push Call Detail Records (CDRs) to remote SFTP servers
• SFTP clients that are used to generate Simple Network Management Protocol (SNMP) reports
• SFTP clients that are used to push device management files
• SSH clients that are used in the software controller and node controller on the Network Function Manager (NFM) that manages Cisco BroadWorks servers
• SSH clients that are used in enterprise migration to push files to a new server.

Note: These services are only impacted when trying to connect to servers that use diffie-hellman-group-exchange-sha1 or diffie-hellman-group-exchange-sha256 key exchange algorithms with a diffie-hellman key size that is not a multiple of 64.

Cisco determined that the /etc/ssh/moduli file that specifies the moduli used for the diffie-hellman group exchange algorithms may be configured on Cisco BroadWorks nodes without a key size that is a multiple of 64.

Cisco BroadWorks customers may experience issues when running CDR reports, SNMP reports, pushing device management files, or pushing files to new BroadWorks servers. Enterprise migrations may fail when attempting to push a file, the node controller might fail to execute the BIND command, and the software controller might fail to apply patches.

The ApacheMinaSshdLog input channel logs may display an error message as shown in the following example:

InvalidAlgorithmParameterException[DH key size must be multiple of 64, and can only range from 512 to 8192 (inclusive). The specific key size 2070 is not supported]

Solution

To resolve this issue, customers must upgrade all Cisco BroadWorks nodes (AS, NS, MS, XS, PS, and NFM servers) to Cisco BroadWorks Release RI.2025.01, which disables diffie-hellman-group-exchange-sha1 and diffie-hellman-group-exchange-sha256.

Workaround

There is no workaround for this issue.

To determine if a Cisco BroadWorks node is affected, use an OpenSSH client and connect to each BroadWorks node. Once connected to the Cisco BroadWorks node, inspect the /etc/ssh/moduli file. This file specifies the moduli used for the diffie-hellman group exchange algorithms. The Size column contains a number that corresponds to the diffie-hellman key size minus one. For example, if an entry in /etc/ssh/moduli has a size of 2047, then the key size is 2048, which is a multiple of 64. If any of these entries +1 is not a multiple of 64, then Cisco BroadWorks SFTP and SSH clients might fail to connect to this server if diffie-hellman-group-exchange-sha1 or diffie-hellman-group-exchange-sha256 are negotiated as key-exchange algorithms.