Courseiva
SecurityPrivileged EXEC

show ip ssh

Displays the status and configuration of SSH server on the Cisco IOS device, used to verify SSH is enabled and check connection details.

Definition: show ip ssh is a Cisco IOS privileged exec command. Displays the status and configuration of SSH server on the Cisco IOS device, used to verify SSH is enabled and check connection details.

Overview

The 'show ip ssh' command is a vital diagnostic tool in Cisco IOS that displays the current status and configuration of the SSH (Secure Shell) server on a device. SSH is a cryptographic network protocol used for secure remote administration and file transfers, replacing insecure protocols like Telnet. This command is essential for network engineers to verify that SSH is enabled, check the SSH version, authentication methods, and connection details such as the number of active sessions.

It is typically used after configuring SSH to ensure the server is running correctly, or during troubleshooting when remote access issues arise. Unlike 'show ssh' which shows only active sessions, 'show ip ssh' provides the server configuration and status. It fits into the broader workflow of securing device access: after generating RSA keys, configuring VTY lines for SSH, and setting the hostname and domain name, you use 'show ip ssh' to confirm the server is operational.

The command requires privileged EXEC mode (enable) and does not alter the running configuration. Output is buffered and may be truncated in long sessions. Understanding this command is crucial for CCNA and CCNP candidates as SSH is a core security feature on Cisco devices.

Syntax·Privileged EXEC
show ip ssh

When to Use This Command

  • Verify that SSH server is enabled and listening on the correct port after configuring SSH.
  • Check the number of active SSH sessions and their details for troubleshooting connectivity.
  • Confirm the SSH version, authentication methods, and encryption algorithms supported.
  • Ensure SSH timeout and retry settings are appropriate for security policies.

Command Examples

Basic show ip ssh output

show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie-Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, ssh-dsa)
SSH-RSA key: 2048-bit
   Encryption: AES-CBC, AES-CTR, 3DES-CBC
   Hash: SHA-1, SHA-256
   Authentication: Publickey, Password
   MAC: HMAC-SHA1, HMAC-SHA1-96

%No SSHv2 server connections running.

Line 1: SSH is enabled with version 2.0. Line 2: Authentication timeout (120 secs) and retries (3). Line 3: Minimum Diffie-Hellman key size. Lines 4-9: SSH host key type and size, supported encryption, hash, authentication, and MAC algorithms. Last line: No active SSH sessions.

Show ip ssh with active sessions

show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie-Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, ssh-dsa)
SSH-RSA key: 2048-bit
   Encryption: AES-CBC, AES-CTR, 3DES-CBC
   Hash: SHA-1, SHA-256
   Authentication: Publickey, Password
   MAC: HMAC-SHA1, HMAC-SHA1-96

Connection Version Mode Encryption  Hmac          State         Username
0          2.0     IN   aes128-cbc  hmac-sha1     Session started   admin
0          2.0     OUT  aes128-cbc  hmac-sha1     Session started   admin

Same initial lines as before. After blank line, a table shows active SSH sessions: Connection number, SSH version, Mode (IN/OUT), Encryption algorithm, HMAC, State (e.g., Session started), and Username. Here, one session (connection 0) for user 'admin' is active.

Understanding the Output

The output begins with SSH status (enabled/disabled) and version. Authentication timeout and retries indicate how long the device waits for login and how many attempts allowed. Minimum Diffie-Hellman key size is a security parameter.

The key section shows the host key type and size (e.g., SSH-RSA 2048-bit). Supported algorithms for encryption, hash, authentication, and MAC are listed. If active sessions exist, a table shows each connection: Connection ID, SSH version, direction (IN/OUT), encryption cipher, HMAC algorithm, session state (e.g., Session started, Authentication in progress), and username.

No sessions means '%No SSHv2 server connections running.' Good values: SSH version 2.0, strong encryption (AES), reasonable timeout (120 secs), retries (3). Watch for version 1.99 (transitional) or disabled SSH.

Configuration Scenarios

Enable SSH Server on a Cisco Router

A network administrator needs to enable SSH on a router for secure remote management. The router currently has no SSH configuration, and Telnet is disabled for security reasons.

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)Admin-PC

Steps

  1. 1.Step 1: Enter global configuration mode: R1> enable
  2. 2.Step 2: Set hostname: R1# configure terminal
  3. 3.Step 3: Set domain name: R1(config)# ip domain-name courseiva.com
  4. 4.Step 4: Generate RSA key pair: R1(config)# crypto key generate rsa modulus 2048
  5. 5.Step 5: Configure VTY lines for SSH: R1(config)# line vty 0 4
  6. 6.Step 6: Set transport input SSH: R1(config-line)# transport input ssh
  7. 7.Step 7: Enable local login: R1(config-line)# login local
  8. 8.Step 8: Exit and verify: R1(config-line)# end
  9. 9.Step 9: Run 'show ip ssh' to verify SSH server status
Configuration
! Full IOS config block
hostname R1
ip domain-name courseiva.com
crypto key generate rsa modulus 2048
line vty 0 4
 transport input ssh
 login local

Verify: R1# show ip ssh SSH Enabled - version 2.0 Authentication timeout: 120 secs; Authentication retries: 3 Minimum expected Diffie-Hellman key size: 1024 bits IOS Keys in SECSH format(ssh-rsa, base64 encoded): ...

Watch out: A common mistake is forgetting to set the hostname and domain name before generating RSA keys; the command will fail with 'No domain name configured'.

Verify SSH Server Configuration After Changes

After modifying SSH parameters such as timeout or retries, an engineer uses 'show ip ssh' to confirm the changes took effect and to check for any active sessions.

Topology

R2(Gi0/0)---10.0.0.0/24---(Gi0/0)Management-Server

Steps

  1. 1.Step 1: Access the router: R2> enable
  2. 2.Step 2: Enter global config: R2# configure terminal
  3. 3.Step 3: Set SSH timeout to 60 seconds: R2(config)# ip ssh time-out 60
  4. 4.Step 4: Set authentication retries to 2: R2(config)# ip ssh authentication-retries 2
  5. 5.Step 5: Exit and verify: R2(config)# end
  6. 6.Step 6: Run 'show ip ssh' to see updated parameters
Configuration
! Full IOS config block
ip ssh time-out 60
ip ssh authentication-retries 2

Verify: R2# show ip ssh SSH Enabled - version 2.0 Authentication timeout: 60 secs; Authentication retries: 2 Minimum expected Diffie-Hellman key size: 1024 bits

Watch out: If you set the timeout too low (e.g., 10 seconds), users may get disconnected during authentication; a typical value is 120 seconds.

Troubleshooting with This Command

When troubleshooting SSH connectivity issues, 'show ip ssh' is the first command to run. Healthy output shows 'SSH Enabled - version 2.0' and reasonable timeout/retry values. If SSH is disabled, the output will say 'SSH Disabled'.

Common problems include: no RSA keys (output shows 'No RSA keys configured'), incorrect VTY transport (SSH not allowed on lines), or firewall blocking port 22. Focus on the 'SSH Enabled' line and the version; version 1 is insecure and should be avoided. If authentication fails, check the 'Authentication retries' and 'Authentication timeout' values.

Correlate with 'show ssh' to see active sessions, 'debug ip ssh' for detailed handshake info, and 'show ip interface brief' to verify IP connectivity. A step-by-step diagnostic flow: 1) Run 'show ip ssh' to confirm server status. 2) If disabled, check RSA keys with 'show crypto key mypubkey rsa'. 3) Verify VTY lines with 'show line vty 0 4' and ensure 'transport input ssh'. 4) Check ACLs on VTY lines with 'show running-config | section line vty'. 5) Test connectivity with 'telnet' from a PC to the router's IP on port 22 (using a tool like PuTTY). 6) If still failing, enable 'debug ip ssh' and reproduce the issue. Common symptoms: 'Connection refused' often means SSH is not enabled or port is blocked; 'Authentication failed' indicates wrong credentials or AAA issues; 'Timeout' suggests network path problems or incorrect timeout settings.

The command also helps in verifying SSH version compatibility; if a client only supports SSHv1, the server must be configured with 'ip ssh version 1' (not recommended).

CCNA Exam Tips

1.

CCNA exam may ask which command verifies SSH is enabled and its version; answer: show ip ssh.

2.

Know that SSH version 2.0 is required for secure management; version 1 is deprecated.

3.

Remember that authentication timeout and retries are configured with 'ip ssh time-out' and 'ip ssh authentication-retries'.

4.

Be aware that 'show ip ssh' does not show SSH client connections; use 'show ssh' for client sessions.

Common Mistakes

Confusing 'show ip ssh' with 'show ssh' — the former shows server config, the latter shows active sessions.

Assuming SSH is enabled when output shows 'SSH Disabled' — must enable with 'ip ssh version 2' and generate keys.

Overlooking that SSH requires a host key pair; if not generated, SSH will not start even if enabled.

show ip ssh vs show ssh

The commands 'show ip ssh' and 'show ssh' are often confused because both relate to SSH, but they serve different purposes. 'show ip ssh' displays the SSH server configuration (e.g., version, port, timeouts), while 'show ssh' shows details about active SSH sessions (e.g., client IPs, encryption algorithms).

Aspectshow ip sshshow ssh
ScopeServer configuration parametersActive session details
OutputSSH version, port, authentication-retries, timeoutsSession ID, client IP, encryption, authentication method
Information typeStatic configuration valuesDynamic connection state
Typical useVerify SSH server is enabled and settingsMonitor currently active SSH sessions

Use show ip ssh when you need to confirm the SSH server is enabled and check its configured parameters like version and timeouts.

Use show ssh when you need to inspect active SSH sessions, such as verifying client connections or troubleshooting encryption mismatches.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'show ip ssh' command syntax and output are nearly identical to classic IOS. However, IOS-XE may include additional fields like 'SSH version 2.0' and 'Authentication method: publickey,password'. On NX-OS (e.g., Nexus switches), the equivalent command is 'show ssh server' which displays similar information but with different formatting.

For ASA firewalls, use 'show ssh' to see SSH server status and sessions; the ASA also supports 'ssh version 2' configuration. In IOS-XR (e.g., ASR 9000), the command is 'show ssh' and the configuration is done via 'ssh server' under the appropriate configuration mode. Differences between IOS versions: In IOS 12.x, the command may show 'SSHv1' if enabled; in 15.x and later, SSHv2 is default.

The 'ip ssh dh min size' parameter was introduced in later versions. Always check the specific platform documentation, but the core functionality remains consistent across Cisco platforms.

Related Commands

crypto key generate rsa

Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.

ip ssh version 2

Enables SSH version 2 on the router for secure remote management, replacing the less secure version 1.

show ssh

Displays the status and configuration of SSH server connections on a Cisco device, used to verify SSH sessions, authentication methods, and encryption settings.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions