Restrictions for Secure Shell Version 2 Support • Secure Shell (SSH) servers and SSH clients are supported in Triple Data Encryption Standard (3DES) software images. • Execution Shell, remote command execution, and Secure Copy Protocol (SCP) are the only applications supported. • Rivest, Shamir, and Adleman (RSA) key generation is an SSH server-side requirement. Devices that act as SSH clients need not generate RSA keys. • The RSA key pair size must be greater than or equal to 768 bits. • The following features are not supported: • Port forwarding • Compression • Starting from Cisco IOS XE Release 17.10, the following Key Exchange and MAC algorithms are removed from the default list:
Key Exchange algorithm: • diffie-hellman-group14-sha1 MAC algorithms: • hmac-sha1 • hmac-sha2-256 • hmac-sha2-512 Note You can use the ip ssh server algorithm kex command to configure the Key Exchange algorithm and the ip ssh server algorithm mac command to configure the MAC algorithms. Information About Secure Shell Version 2 Support Secure Shell Version 2 The Secure Shell Version 2 Support feature allows you to configure SSH Version 2. The configuration for the SSH Version 2 server is similar to the configuration for SSH Version 1. The ip ssh version command defines the SSH version to be configured.
If you do not configure this command, SSH by default runs in compatibility mode; that is, both SSH Version 1 and SSH Version 2 connections are honored. Secure Shell Version 2 Support Restrictions for Secure Shell Version 2 Support Secure Shell Version 2 Support 2