Courseiva
SecurityGlobal Config

ip ssh version 2

Enables SSH version 2 on the router for secure remote management, replacing the less secure version 1.

Definition: ip ssh version 2 is a Cisco IOS global config command. Enables SSH version 2 on the router for secure remote management, replacing the less secure version 1.

Overview

The `ip ssh version 2` command is a global configuration command on Cisco IOS devices that restricts the SSH server to accept only version 2 connections. SSH (Secure Shell) provides encrypted remote access to network devices, replacing insecure protocols like Telnet. Version 2 offers significant security improvements over version 1, including stronger encryption algorithms, integrity checking, and resistance to cryptographic attacks.

This command is essential for compliance with security best practices and many regulatory standards (e.g., PCI DSS, HIPAA) that mandate the use of SSHv2. When configuring remote management, you would typically first enable SSH by generating RSA keys (`crypto key generate rsa`), then set the SSH version to 2. Without this command, the router may negotiate version 1 if the client requests it, creating a vulnerability.

The command is part of a broader secure management workflow that includes configuring VTY lines for SSH-only access, setting timeouts, and using AAA for authentication. It is important to note that this command only affects incoming SSH connections; it does not impact SSH client behavior when the router initiates outbound SSH. The command takes effect immediately and is saved to the running configuration.

There is no impact on other services. The privilege level required is 15 (enable mode). This command is available in IOS 12.x and later; in earlier versions, SSH version 2 may not be supported.

When troubleshooting SSH connectivity issues, verifying the SSH version is a common step. The command is simple but critical for hardening network devices. It is often one of the first commands applied in a security baseline configuration.

In summary, `ip ssh version 2` is a straightforward yet vital command for ensuring secure remote management, and its use is strongly recommended in all modern networks.

Syntax·Global Config
ip ssh version 2

When to Use This Command

  • Configuring SSHv2 to meet security compliance requirements (e.g., PCI DSS, HIPAA) that mandate strong encryption.
  • Replacing Telnet with SSHv2 for all remote access to prevent password sniffing and man-in-the-middle attacks.
  • Enabling SSHv2 on a router that will be managed from a jump host that only supports SSHv2.
  • Preparing a router for automated configuration management tools (e.g., Ansible, SaltStack) that require SSHv2.

Parameters

ParameterSyntaxDescription
version2Specifies that the SSH server should accept only version 2 connections. The only valid value is 2. There is no other parameter; the command is simply 'ip ssh version 2'. A common mistake is to omit this command entirely, leaving the router vulnerable to version 1 fallback.

Command Examples

Enable SSH version 2 globally

ip ssh version 2
Router(config)# ip ssh version 2
Router(config)#

The command is entered in global configuration mode. No output confirms success. The router now accepts only SSHv2 connections.

Verify SSH version configuration

show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie-Hellman key size: 1024 bits
IOS Keys in SECSH format(ssh-rsa, ssh-dss)
Router-1.example.com

Line 1: 'SSH Enabled - version 2.0' confirms SSHv2 is active. Line 2: Shows authentication timeout (120 seconds) and retries (3). Line 3: Minimum DH key size for key exchange. Line 4: Lists supported public key formats. Line 5: Hostname of the router.

Understanding the Output

The 'show ip ssh' command displays the current SSH configuration. The first line indicates whether SSH is enabled and the version (2.0 is desired). The authentication timeout (default 120 seconds) and retries (default 3) control how long a client has to authenticate.

The Diffie-Hellman key size minimum (1024 bits) ensures strong key exchange. The 'IOS Keys in SECSH format' line shows the public key types available (rsa, dss). The hostname confirms the router's identity.

A good configuration shows version 2.0; version 1.99 or 1.5 indicates SSHv1 is also enabled, which is a security risk.

Configuration Scenarios

Enable SSH version 2 on a router for secure remote management

A network administrator needs to ensure that all remote access to the router uses the more secure SSH version 2. The router currently has SSH enabled but may accept version 1 connections.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)Admin-PC

Steps

  1. 1.Step 1: Enter global configuration mode: R1> enable
  2. 2.Step 2: R1# configure terminal
  3. 3.Step 3: Generate RSA keys (if not already done): R1(config)# crypto key generate rsa modulus 2048
  4. 4.Step 4: Set SSH version to 2: R1(config)# ip ssh version 2
  5. 5.Step 5: Configure VTY lines for SSH only: R1(config)# line vty 0 4
  6. 6.Step 6: R1(config-line)# transport input ssh
  7. 7.Step 7: R1(config-line)# login local
  8. 8.Step 8: Exit and save: R1(config-line)# end; R1# write memory
Configuration
! Full IOS config block
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# end

Verify: Use 'show ip ssh' to verify the SSH version is set to 2. Expected output includes 'SSH Enabled - version 2.0'. Also use 'show ssh' to see active sessions.

Watch out: If RSA keys are not generated before setting the SSH version, the command will be accepted but SSH will not function until keys are created. Always generate keys first.

Upgrade SSH from version 1 to version 2 on a legacy router

A router was previously configured with SSH version 1 for compatibility with older management stations. Now all management stations support version 2, so the administrator wants to enforce version 2 for better security.

Topology

R2(Gi0/0)---10.10.10.0/24---(Gi0/0)Management-Station

Steps

  1. 1.Step 1: Enter global configuration mode: R2> enable
  2. 2.Step 2: R2# configure terminal
  3. 3.Step 3: Check current SSH version: R2# show ip ssh (note version 1.x)
  4. 4.Step 4: Change to version 2: R2(config)# ip ssh version 2
  5. 5.Step 5: Optionally, regenerate RSA keys with larger modulus: R2(config)# crypto key generate rsa modulus 4096
  6. 6.Step 6: Verify the change: R2# show ip ssh
  7. 7.Step 7: Test SSH connection from management station to ensure compatibility.
Configuration
! Full IOS config block
R2(config)# ip ssh version 2
R2(config)# crypto key generate rsa modulus 4096
R2(config)# end

Verify: Use 'show ip ssh' to confirm version 2.0. Also check that existing SSH sessions are not disrupted; new sessions will use version 2.

Watch out: Changing the SSH version does not affect active SSH sessions; they continue with the version negotiated at connection time. To enforce version 2 for all sessions, disconnect existing sessions or wait for them to end.

Troubleshooting with This Command

When troubleshooting SSH connectivity issues, the `show ip ssh` command is the primary tool to verify the SSH version configuration. Healthy output shows 'SSH Enabled - version 2.0' and includes details like authentication timeout, retries, and key type. If the output shows version 1.0 or 1.99 (which indicates version 1.99 is actually version 2 with backward compatibility), the router may be vulnerable.

Problem indicators include 'SSH Disabled' or 'SSH version 1.0'. If SSH connections fail, first verify that the SSH version is set to 2 and that RSA keys are present with `show crypto key mypubkey rsa`. Also check VTY line configuration with `show running-config | include transport input` to ensure SSH is allowed.

Common symptoms: 'Connection refused' often means SSH is not enabled or VTY lines are misconfigured. 'No matching cipher' indicates the client and server cannot agree on encryption; this can happen if the client only supports version 1. In that case, either upgrade the client or (not recommended) revert to version 1.99.

A step-by-step diagnostic flow: 1) Check `show ip ssh` for version and status. 2) Verify RSA keys with `show crypto key mypubkey rsa`. 3) Check VTY configuration with `show running-config | section line vty`. 4) Test from a client with verbose output (e.g., `ssh -v 2`). 5) Use debug commands: `debug ip ssh` to see negotiation details. Correlate `show ip ssh` output with `show ssh` to see active sessions and their version. If the router is acting as an SSH client, the version is determined by the client software, not this command.

In summary, `ip ssh version 2` is a simple command, but misconfiguration can lead to connectivity issues; systematic verification is key.

CCNA Exam Tips

1.

CCNA exam tip: SSHv2 is required for secure management; Telnet and SSHv1 are deprecated. Always configure 'ip ssh version 2'.

2.

CCNA exam tip: Before enabling SSH, you must configure a hostname and domain name (ip domain-name) and generate RSA keys (crypto key generate rsa).

3.

CCNA exam tip: The 'show ip ssh' command is used to verify SSH version and parameters; look for 'version 2.0'.

4.

CCNA exam tip: SSHv2 uses stronger encryption algorithms (e.g., AES, 3DES) and supports Diffie-Hellman key exchange.

Common Mistakes

Mistake 1: Forgetting to generate RSA keys before enabling SSH — SSH will not work. Use 'crypto key generate rsa' with modulus >= 2048.

Mistake 2: Setting 'ip ssh version 2' but not removing older SSH version 1 transport — use 'ip ssh version 2' alone disables v1.

Mistake 3: Not configuring VTY lines to accept SSH — must use 'transport input ssh' under line vty 0 15.

ip ssh version 2 vs crypto key generate rsa

Both commands are essential for SSH configuration on Cisco devices but serve different purposes: 'crypto key generate rsa' creates the encryption keys, while 'ip ssh version 2' specifies the SSH protocol version. They are often confused because both appear under global config and are required for secure SSH access.

Aspectip ssh version 2crypto key generate rsa
ScopeConfigures SSH protocol versionGenerates RSA key pair for encryption
Configuration ModeGlobal configurationGlobal configuration
PersistenceSaved in running config; persists after reloadKeys stored in NVRAM; persist after reload
PrecedenceRequires existing RSA keys; no effect without keysMust be executed before enabling SSH; keys persist independently
Typical UseSet after key generation to enforce SSHv2First step to enable SSH; then specify version

Use ip ssh version 2 after RSA keys exist to enforce only SSHv2 connections, disabling vulnerable SSHv1.

Use crypto key generate rsa to create the RSA key pair needed for SSH, specifying a modulus size of at least 1024 bits for SSHv2.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the command syntax is identical: `ip ssh version 2`. However, the output of `show ip ssh` may include additional fields like 'SSH key exchange algorithms' in newer versions. In NX-OS (e.g., Nexus switches), the equivalent command is `ssh version 2` under the 'feature ssh' configuration.

The syntax is: `switch(config)# ssh version 2`. NX-OS also requires enabling the SSH feature with `feature ssh`. In ASA firewalls, SSH version is configured under the 'ssh' command: `ssh version 2` (in global config mode).

The ASA also uses `crypto key generate rsa` similarly. In IOS-XR, the command is `ssh server version 2` under the 'ssh server' configuration context. For example: `RP/0/RP0/CPU0:router(config)# ssh server version 2`.

IOS-XR also requires generating RSA keys with `crypto key generate rsa`. Note that in older IOS versions (12.x), the command `ip ssh version 2` may not be available; instead, the default is version 1.99 (compatible mode). In IOS 15.x and later, version 2 is the default if RSA keys are generated, but it is still good practice to explicitly set it.

In IOS 16.x, the behavior is the same. Always check the specific platform documentation, as some low-end switches may not support SSH version 2.

Related Commands

crypto key generate rsa

Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.

ip domain-name [domain]

Configures the default domain name appended to incomplete hostnames during DNS resolution, enabling the router to resolve unqualified names into fully qualified domain names.

show ip ssh

Displays the status and configuration of SSH server on the Cisco IOS device, used to verify SSH is enabled and check connection details.

transport input ssh

Restricts incoming Telnet or SSH connections on a VTY line to only SSH, blocking unencrypted Telnet access for secure remote management.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions