System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

DSCP marking for SSH packets

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains when CiscoSSH marks client and server packets and how connection-phase marking prevents initial SSH handshake packets from being filtered.

DSCP marking for SSH packets is a traffic-classification behavior that

  • marks CiscoSSH client packets during the TCP connection phase

  • can mark server packets before authentication when explicitly enabled, and

  • helps prevent transit policies from dropping unmarked handshake packets.

OpenSSH 8.0 marks packets only after authentication. OpenSSH 8.5 and later mark client packets during TCP connection establishment; Cisco IOS XR Software Release 24.1.1 brings this behavior to CiscoSSH. Server packets still require ssh server set-dscp-connection-phase for early marking.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

DSCP Marking from TCP Connection Phase for SSH Packets

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

DSCP Marking from TCP Connection Phase for SSH Packets

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

DSCP Marking from TCP Connection Phase for SSH Packets

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

DSCP Marking from TCP Connection Phase for SSH Packets

Release 24.1.1

We now prevent SSH client packet drops in the TCP connection (initial handshake) phase as they travel across transit routers in the network. This is because you can mark the DSCP values for SSH client packets in the TCP connection phase, which overrides the transit routers' policies to filter and drop packets with no DSCP value marked. Using a new command, you can also set the DSCP value from the TCP connection phase for SSH server packets.

The feature introduces these changes:

CLI:

YANG Data Model:

Set DSCP marking during SSH connection establishment

Mark server handshake packets before SSH authentication so transit policies do not treat them as unmarked traffic.

The command is available with CiscoSSH and Cisco IOS XR SSH, but the configuration is relevant only to CiscoSSH.

Procedure

  1. Enable connection-phase DSCP marking and commit the SSH server configuration.

    Example:

    Router# configure
Router(config)# ssh server set-dscp-connection-phase
Router(config-ssh)# commit

  2. Verify the running SSH configuration.

    Example:

    Router# show run ssh
ssh server set-dscp-connection-phase

CiscoSSH marks server packets with the configured DSCP value during TCP connection establishment.