System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Configure an SSH server

Updated: September 18, 2026

Want to summarize with AI?

Log in

Configures a router to accept secure SSH connections and optionally sets transfer scaling, authentication timeout, access controls, packet marking, and session verification.

Enable secure inbound management access to the router.

Before you begin

  • Meet the access, VRF, AAA, and host-key requirements.

  • Identify any IPv4 or IPv6 ACLs that must restrict incoming connections.

Procedure

  1. Configure the router identity and enable the SSH server in global configuration mode.

    Example:

    Router# configure
Router(config)# hostname router1
Router(config)# domain name example.com
Router(config)# ssh server v2

    Use ssh server vrf with optional IPv4 and IPv6 ACLs when the server must operate in a specific VRF or restrict clients. The server supports multiple VRFs.

  2. Optionally configure transfer scaling, AAA authentication timeout, and packet marking.

    Example:

    Router(config)# ssh server tcp-window-scale 10
Router(config)# ssh timeout 60
Router(config)# ssh server dscp 63
Router(config)# commit

    • The TCP window scale can improve in-band SCP and SFTP throughput.

    • The authentication timeout range is 5 through 120 seconds; the default is 30 seconds.

    • The DSCP range is 0 through 63; the default is 16.

  3. Verify active and historical SSH session information.

    Example:

    Router# show ssh
Router# show ssh session details
Router# show tech-support ssh

    • show ssh displays all of the incoming and outgoing SSHv1 and SSHv2 connections to the router.

    • show ssh session details displays a detailed report of the SSHv2 connections to and from the router.

    • show tech-support ssh automatically runs the show commands that display system information.

The router accepts supported SSH client connections on the configured VRFs and applies the optional controls.