SRX devices may experience delayed SSH login prompts and slow authentication response times when initiating SSH sessions. 

The following behavior was consistently observed:

• Device running on 21.2, SSH login time ranged between 3–6 seconds
• Device running on 23.4, SSH login delay increased to 8–18 seconds
• Multiple rounds of testing confirmed consistent slowness on the 23.4 device
• No packet drops or resource constraints were observed; the issue was isolated to SSH initialization

The SSH slowness is caused by a combination of:

1. Legacy Operating System

• Junos versions prior to 24.4 run on FreeBSD 6, an older OS with limited efficiency when handling modern cryptography.

2. Modern OpenSSH Code Base

• Devices run OpenSSH 9.7, which loads multiple host keys during SSH session initialization.
• On FreeBSD 6, this process incurs additional overhead, resulting in delayed SSH responses.

Permanent Resolution

• Upgrade to Junos with FreeBSD 12 (Junos 24.4+), the same OpenSSH version performs efficiently.
• SSH login response times return to normal and the issue is fully resolved.

Workarounds

Workaround 1 — Disable RSA and ECDSA Host Key Algorithms

set system services ssh hostkey-algorithm no-ssh-rsa
set system services ssh hostkey-algorithm no-ssh-ecdsa

Effect:

• SSH response time improves
• NOT RECOMMENDED for Mist-managed devices
• → The SRX disconnects from Mist since Mist–SRX communication uses outbound SSH.

Workaround 2 — Restrict Host Key Algorithms to RSA

set system services ssh hostkey-algorithm-list rsa

Effect:

• SSH response typically improves
• Mist connectivity remains stable
• Recommended workaround for WAN Assurance environments