Explains core SSH functions and CiscoSSH behavior, and provides server, client, NETCONF, host-key, multiplexing, cipher, and HMAC configuration guidance.
Use this chapter to understand SSH behavior and configure secure remote-management access on Cisco IOS XR routers.
The chapter provides information in these functional areas:
-
SSH clients, servers, secure file transfer, authentication methods, and software packaging
-
CiscoSSH behavior, implementation differences, requirements, recommendations, and session messages
-
SSH server and client configuration, NETCONF access controls, and host-key management
-
SSH authentication order, multichannel connections, cipher selection, and HMAC controls
Secure Shell fundamentals
Explains how SSH secures remote sessions and provides client, server, file-transfer, authentication, and software-package functions on Cisco IOS XR routers.
CiscoSSH
Explains the OpenSSH-based Cisco implementation, including post-quantum key exchange, implementation differences, restrictions, operating recommendations, and session-event messages for secure router management.
Requirements for Secure Shell
Provides user access-control, VRF, AAA, host-key, and SFTP requirements that must be satisfied before configuring or using secure SSH services.
Secure Shell restrictions
Describes host-key, FIPS, SFTP, authentication, application, cipher, terminal, password, and file-system restrictions that apply to SSH services on Cisco IOS XR routers.
Configure an SSH server
Configures a router to accept secure SSH connections and optionally sets transfer scaling, authentication timeout, access controls, packet marking, and session verification.
NETCONF access controls
Explains how NETCONF access controls separate management requests from other SSH services by port and ACL while preserving SCP and SFTP access.
Automatic generation of SSH host keys
Explains automatic SSH host-key generation, allowed host-key selection, Ed25519 support, FIPS restrictions, verification, and manual key management on the router.
Configure an SSH client
Configures server host-key validation and starts an authenticated outbound SSH connection from a Cisco IOS XR router to a remote server.
SSH client authentication order
Describes the default order in which Cisco IOS XR SSH and CiscoSSH clients negotiate public-key, password, and keyboard-interactive authentication.
SSH multichannel connections
Explains how SSH multiplexing carries concurrent shell, remote-command, and secure file-transfer channels through one authenticated TCP connection between a client and server.
Configure an OpenSSH client for multiplexing
Configures an OpenSSH client to reuse a primary authenticated SSH connection for later service sessions to the same remote server.