In this scenario, the customer cannot SSH from the Juniper router (MX960) to this Nokia 7210. The customer saw the same behavior from other JUNOS devices going to the Nokia 7210 device.

When trying to SSH from the JUNOS device to the other vendor device, we will see the following error msg:

ssh_dispatch_run_fatal: Connection to x.x.x.x port 22: DH GEX group out of range

This error has something to do with the key exchanges between the Juniper router and other vendor devices.

The "diffie-hellman-group1-sha1" algorithm was specified by default in the Junos OS releases before 16.1R1, but after that, we need to specify it on JUNOS devices manually. We can manually add the config using the below command:

set system services ssh key-exchange dh-group1-sha1

NOTE: After adding the above config, please make sure the ssh for all other devices connected to the JUNOS device are working without any issues. Other devices might be following other key-exchange methods. When the above command is added, the JUNOS will use only "Diffie-hellman-group1-sha1". If some other device in the network needs another key exchange method please add it to the above command. For example, if there's another Cisco device using "curve25519-sha256" then following command needs to be configured:

set system services ssh key-exchange [ dh-group1-sha1 curve25519-sha256]

Possible options for the ssh key-exchange: 

curve25519-sha256  The EC Diffie-Hellman on Curve25519 with SHA2-256 hash

 dh-group1-sha1    The RFC 4253 mandated group1 with SHA1 hash

 dh-group14-sha1   The RFC 4253 mandated group14 with SHA1 hash

 ecdh-sha2-nistp256  The EC Diffie-Hellman on nistp256 with SHA2-256

 ecdh-sha2-nistp384  The EC Diffie-Hellman on nistp384 with SHA2-384

 ecdh-sha2-nistp521  The EC Diffie-Hellman on nistp521 with SHA2-512

 group-exchange-sha1 The RFC 4419 group exchange with SHA1 hash

 group-exchange-sha2 The RFC 4419 group exchange with SHA2-256 hash