SSH-Session to Cisco not possible (ROS v7.8) - no matching key algorithm

RouterOS General
1

Dear Gurus,
i try to connect to a cisco Catalyst 9200 (Cisco IOS XE Software, Version 17.03.04b) via Tools → Telenet → SSH which leads to an immidiate disconnect.
I enabled the /ip/ssh strong-crypto to get over problems with MAC algorithmus. That is working now - they do hmac-sha2-256
But then I stumble across the kex algorithmus:

  • Mikrotik offers: curve25519-sha256,diffie-hellman-group-exchange-sha256,ext-info-c


  • Cisco offers: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1

So we have no match.
Is there a possibility to get connected?

Thanks a lot,
Bernhard

2

Yes … using a full-blown ssh client which in fact still implements outdated algorithms but doesn’t have them enabled by default.

3

What I really wanted to know - is there a possibility to get connected to the cisco switch using a MikroTik router?
Is there a full-blown ssh client for MikroTik Routerboard?

4

It seems it’s not possible using built-in ssh client at the moment.

Not really. Some Mikrotik routers, running v7 (e.g. 7.:sunglasses: can run containers … and you could include full-blown ssh client in a container. Not exactly light-weight solution … if I would need connectivity and none of linux machines running all the time, I’d go with raspberry pi …

5

OK - thanks. Doesn’t make me happy.

6

You want the network traffic to originate from the Mikrotik device (from Cisco device’s point of view), but you do this from your workstation, no? You can use ssh jump host functionality for this. Search for these keywords for details.

The call would look something like this:

ssh -J admin@mikrotik -o enable-legacy-option -o enable-deprecated-option admin@cisco

Works well will Mikrotik device as jump host.