ASA Firewall SSH DH Key Exchange error
Once again, configuring a new ASA Firewall and I've gone to SSH into it using SecureCRT and found I can't. When I attempted to SSH, I received the following error.
Key exchange failed.
No compatible key-exchange method. The server supports these methods: diffie-hellman-group14-sha256
This only seems to affect SecureCRT and seems to work fine for Putty. As the error states, the particular DH settings are not supported when using SecureCRT (It does also affect other SSH applications from my google search). In order to resolve this issue, you need to change the SSH settings on the firewall to something like Group 14 SHA1. There are 2 ways to do this. You can either use Putty and SSH to the device and change it via CLI, or you can use ASDM to change the DH Key Exchange setting. In this post I will go through both options. Given the CLI is the easiest option I'll go through that first.
Given the putty works, I'. Going to use that to configure the CLI settings. Open up putty and SSH to your firewall. Once logged in, enter conf t and then enter the command ssh key-exchange group dh-group14-sha1.
and that's it for the CLI config. Now lets go through ASDM. Open ASDM and log into your Firewall. Once logged in navigate to Configuration in the top menu.
On the Configuration page, select Device Management from the menu on the left at the bottom.
Under Device Managment, expand Management Access and select ASDM/HTTPS/Telnet/SSH
On this page, you will see the DH Key Exchange settings. Select the Group 14 SHA1 option and click Apply at the bottom then Save at the top.
That's it. You should now be able to SSH into your ASA Firewall using SecureCRT (Or whatever application you're using)
Add new comment