This article helps to troubleshoot and resolve SSH connectivity issues when attempting to initiate SSH sessions from lo0 or irb interfaces

The following symptoms may be observed:

• SSH sessions initiated from the lo0 interface fail to reach peer devices
• SSH traffic sourced from irb interfaces is unreachable
• SSH works successfully when sourced from management interfaces em0,me0 and fxp0
• No response or timeout observed during SSH attempts
• Routing or reachability to the source IP exists, but SSH connection still fails
• MTU values being different on the physical interfaces connecting to the peer devices.

To resolve the issue, perform the following checks and corrective actions:

• Ensure the peer device has a valid return route to the lo0 or irb source IP address.
• Confirm that SSH is explicitly allowed and not restricted by a configured source address:

root@user#show configuration system services ssh

• Check for firewall filters applied to lo0 or irb interfaces that may be blocking SSH (TCP port 22):

roo@user#show configuration firewall

• If SSH is initiated towards the device, ensure SSH is permitted under host-inbound-traffic.
• If SSH is initiated from the device, ensure no restrictive host or control-plane filters exist.
• Verify whether lo0 or irb interfaces are part of a routing instance and ensure correct import, export policies if required.
• Ensure SSH traffic sourced from lo0/irb is not unintentionally routed via the management VRF.
• Ensure lo0 and irb interfaces are up and correctly configured with valid IP addresses.
• Configure same MTU values between the source and peer end devices to overcome any fragments of packets.

root@user>show interfaces <interface-name> extensive | match mtu

• Check if the ssh ciphers are matching from COS (client to server) and SOC (server to client).

root@user>ssh username@<ip-address> interface <lo0 or irb> extensive | no-more

root@user>show log messages | match ssh

root@user>show system connections | match 22

After applying the appropriate fixes, retry the SSH connection and confirm successful access to the peer end device. If still the issue persists, please reach out to JTAC for further assistance.