System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Secure Shell fundamentals

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how SSH secures remote sessions and provides client, server, file-transfer, authentication, and software-package functions on Cisco IOS XR routers.

Secure Shell (SSH) is an application and protocol that

  • replaces unencrypted Berkeley remote-access tools

  • uses cryptographic mechanisms to authenticate and protect sessions, and

  • supports remote command execution and secure file transfer.

Cisco IOS XR supports SSHv1 and SSHv2. SSHv1 uses RSA keys. SSHv2 supports DSA, RSA, and ECDSA keys. CiscoSSH is the OpenSSH-based implementation available from Cisco IOS XR Software Release 7.3.2.

Table 1. Feature History Table
Feature Name Release Information Feature Description
Implementing Secure Shell Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8711-48Z-M

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D
Implementing Secure Shell Release 24.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC:K100])(select variants only*).

Secure Shell (SSH) provides encrypted communication for secure remote management of network devices. This feature enhances security by protecting against eavesdropping and unauthorized access during remote sessions. By implementing SSH, administrators can ensure secure command-line interface access, safeguarding sensitive data and maintaining the integrity of network operations.

*Previously this feature was supported on Q200 and Q100. It is now extended to Cisco 8712-MOD-M routers.

SSH limitations

  • Cisco IOS XR does not support X11 forwarding through an SSH connection.

  • References to CiscoSSH apply to the OpenSSH-based implementation unless a topic explicitly identifies the older Cisco IOS XR SSH implementation.

SSH clients and servers

SSH clients and servers are complementary applications that

  • establish encrypted connections across an insecure network

  • authenticate the router, remote device, and user, and

  • provide functions comparable to inbound and outbound Telnet without sending the session in clear text.

The SSH server accepts connections from publicly and commercially available clients. The SSH client connects the router to Cisco routers and other SSH servers.

SSH client support

  • Authentication sources: RADIUS, TACACS+, and locally stored usernames and passwords

  • Legacy client algorithms stated by the source: AES, 3DES, and SHA-1

  • DSCP range: 0 through 63

  • Default client and server DSCP value when it is not configured: 16

Use the ssh client command in XR Config mode to configure SSH client options.

The router can execute a command on a remote device as part of an outbound SSH session.

How secure file transfers work

SFTP is an SSHv2 subsystem that securely copies router configuration and image files. The client is always enabled and supports VRF-aware and interactive operation.

Note

The SSH server must be running to accept incoming SFTP connections.

Summary

The process uses these components:

  • SFTP client: Sends the file-transfer request.

  • SSH server: Authenticates the user and creates a child session.

  • SFTP server: Processes file requests through a request-response protocol.

  • LPTS policer: Controls the SSH-known packet rate.

Workflow

These stages describe a secure file transfer:

  1. The user runs the sftp command. The SFTP API creates a child session that interacts with the SSH server.

  2. For each incoming request, the SSH server creates an SSH server child process. The child process establishes a secure channel through key exchange and user authentication.

  3. If the client requests the SFTP subsystem, the SSH server daemon creates an SFTP server child process and instance. The server authenticates the session, initiates the connection, and sets the client environment and default user directory.

  4. The SFTP server waits for an SSH_FXP_INIT message. The client then sends requests, and the server returns status, handle, data, or name responses.

  5. The client and server transfer data through the encrypted channel. The SSH-Known LPTS policer applies to the transfer.

Result

The client and server exchange files over an authenticated and encrypted SSH session.

SSH authentication methods

Use this information to distinguish server verification from user authentication.

SSH supports these authentication methods:

  • Host authentication: The client verifies the public key supplied by the server during key exchange. A changed known-host key causes the client to close the connection.

  • RSA user authentication: The user proves possession of a private RSA key by sending a signature. The corresponding public key is stored on the server.

  • Password authentication: This method is the default when the server supports it.

  • Keyboard-interactive authentication: The client accepts interactive prompts without knowing the underlying authentication mechanism. This method supports interactive applications only.

RSA user keys have these source limits:

  • Minimum length: 512 bits

  • Maximum length: 4096 bits

  • Import format: Base64-encoded binary format

SSH and SFTP software packages

Use this information to determine which software package supplies each security component.

The software packages contain these components:

  • Base package: SSH, SFTP, management-plane components, and control-plane components such as the IPsec control plane

  • Security package: Data-plane components such as MACsec and the IPsec data plane

Both packages allow FIPS operation so that the control plane can negotiate FIPS-approved algorithms.