Cisco CRS User Manual

ssh
To start the Secure Shell (SSH) client connection and enable an outbound connection to an SSH server, use
the ssh command.
ssh [vrf vrf-name] {ipv4-address| ipv6-address| hostname} [username user-id] [cipher aes {128-cbc|
192-cbc| 256-cbc}][source-interface type interface-path-id][commandcommand-name]
Syntax Description
Specifies the name of the VRF associated with this connection.
vrfvrf-name
IPv4 address in A:B:C:D format.
ipv4-address
IPv6 address in X:X::X format.
ipv6-address
Hostname of the remote node. If the hostname has both IPv4 and IPv6 addresses,
the IPv6 address is used.
hostname
(Optional) Specifies the username to use when logging in on the remote
networking device running the SSH server. If no user ID is specified, the default
is the current user ID.
usernameuser-id
(Optional) Specifies Advanced Encryption Standard (AES) as the cipher for the
SSH client connection.
If there is no specification of a particular cipher by the administrator,
the client proposes 3DES as the default to ensure compatibility.
Note
cipheraes
128-bit keys in CBC mode.128-CBC
192-bit keys in CBC mode.192-CBC
256-bit keys in CBC mode.256-CBC
(Optional) Specifies the source IP address of a selected interface for all outgoing
SSH connections.
source interface
Interface type. For more information, use the question mark (?)online help
function.
type
Physical interface or virtual interface.
Use theshowinterfaces command in EXEC mode to see a list of all
interfaces currently configured on the router.
Note
For more information about the syntax for the router, use the question
mark(?)online help function.
interface-path-id
(Optional) Specifies a remote command. Adding this keyword prompts the
SSHv2 server to parse and execute thesshcommand in non-interactive mode
instead of initiating the interactive session.
command
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
OL-24740-01 269
Secure Shell Commands
ssh

Cisco CRS Specifications

General

Operating System	Cisco IOS XR
Product Type	Core Router
Form Factor	Modular Chassis
Dimensions	Varies by chassis type
Weight	Varies by chassis type
Architecture	Distributed
Switch Fabric	Multi-stage
Interface Support	Ethernet, SONET/SDH, OTN
Interfaces/Ports	Varies by line card
Port Density	Varies by line card
Routing Protocol	BGP, IS-IS, OSPF, MPLS
Management	CLI, SNMP
Power Supply	Redundant, hot-swappable
Cooling	Redundant, Hot-swappable Fan Trays
Supported Protocols	IPv4, IPv6, MPLS
Management Interfaces	Ethernet, console
Security Features	ACLs

Summary

Preface

Document Change History

Lists technical changes made to the document since its initial release.

Documentation and Service Request Procedures

Provides information on obtaining documentation and submitting service requests.

Authentication, Authorization, and Accounting Commands

AAA Accounting Configuration

Configures AAA accounting methods for commands, EXEC sessions, network services, or system events.

AAA Authentication Configuration

Configures AAA authentication method lists for login, PPP, or subscriber authentication.

AAA Authorization Configuration

Configures AAA authorization method lists for commands, EXEC sessions, network services, or subscribers.

RADIUS Server Key Configuration

Specifies the authentication and encryption key for RADIUS communications between router and daemon.

TACACS+ Server Host Configuration

Specifies a TACACS+ host server, including its name or IP address and port.

IPSec Commands

Clear IPSec Security Associations

Deletes specific or all IPSec security associations (SAs) from the SADB or clears counters/interfaces.

Show IPSec SA Information

Displays security association (SA) information based on rack/slot/module location, peer, profile, or count.

Configure IPSec Tunnel Encapsulation

Sets the encapsulation mode for a tunnel interface, specifying GRE or IPv4.

Keychain Management Commands

Keychain Key Configuration

Creates or modifies a keychain key, specifying a 48-bit integer key identifier.

Keychain Management

Creates or modifies a keychain, specifying its name and maximum character limit.

Show Keychain Status

Displays the keychain status, including keys, tolerance, lifetimes, and cryptographic algorithm.

Lawful Intercept Commands

Disable Lawful Intercept Feature

Disables the Lawful Intercept (LI) feature, which also deletes associated Mediation Devices and TAPs.

Management Plane Protection Commands

Configure Management Traffic IP Address

Configures peer IPv4 or IPv6 addresses for management traffic allowed on an interface.

Allow Management Traffic Protocols

Configures an interface to allow peer-filtering for specified management protocols or all protocols.

Configure Management Plane Protection

Configures management plane protection to allow and disallow protocols.

Configure Out-of-Band Management

Configures out-of-band interfaces or protocols and enters management plane protection out-of-band configuration mode.

Public Key Infrastructure Commands

Authenticate Certificate Authority

Authenticates the CA to the router by obtaining the CA's certificate and verifying its fingerprint.

Configure Trusted Certificate Authority

Declares a CA and configures a trusted point for verifying peer certificates.

Generate RSA Key Pair

Generates Rivest, Shamir, and Adelman (RSA) key pairs for signing and encryption.

Software Authentication Manager Commands

Add Certificate to SAM Table

Adds a new certificate to the SAM certificate table, with or without validation.

Show SAM Certificate Information

Displays records in the SAM certificate table, including location, index, and flag.

Show SAM System Information

Displays current configuration settings, status, prompt interval, and default response for SAM.

Secure Shell Commands

Start SSH Client Connection

Starts an SSH client connection and enables an outbound connection to an SSH server.

Configure SSH Server

Enables the SSH server, configures VRFs for its use, and sets the server version to SSHv2.

Authenticate SSH Server Public Key

Authenticates a server public key (pubkey) by storing it in the client's local database.

Secure Socket Layer Protocol Commands

Show Active SSL Sessions

Displays active Secure Socket Layer (SSL) sessions, showing PID, Method, Type, Peer, Port, and Cipher-Suite.