Netconf over SSH session may fail to establish in rare conditions with the EVO platform. This issue might occur under one of the following circumstances: 1- Adding the configuration of Netconf and SSH cipher configuration 2- performing a "commit full" which will (with NETCONF and SSH ciphers config present ) 2- performing a "load override" (with NETCONF and SSH ciphers config present )
The netconf connection will fail due to "kex_exchange_identification: read: Connection reset by peer" root@server1:~$ssh -c aes256-ctr [email protected] -p 830 kex_exchange_identification: read: Connection reset by peer
Additionally, on the device's side, we will see logs indicating that the NETCONF connection is failing.
Sep 2 22:27:02 EVOvSCAPA1-RE0-re0 sshd[19113]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:29:40 EVOvSCAPA1-RE0-re0 sshd[21113]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:29:43 EVOvSCAPA1-RE0-re0 sshd[21137]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:29:55 EVOvSCAPA1-RE0-re0 sshd[21338]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:51:28 EVOvSCAPA1-RE0-re0 sshd[13270]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:51:54 EVOvSCAPA1-RE0-re0 sshd[13645]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:51:56 EVOvSCAPA1-RE0-re0 sshd[13745]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:51:58 EVOvSCAPA1-RE0-re0 sshd[13747]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block Sep 2 22:51:59 EVOvSCAPA1-RE0-re0 sshd[13757]: fatal: /etc/ssh/netconf_config line 10: Directive 'Ciphers' is not allowed within a Match block
Until we have the proper software fix for the issue described in PR 1831167, we can use the following options to recover:
1- If it's acceptable we can remove the SSH cipher configuration which should solve this issue2- delete and add the SSH cipher and NETCONF configuration
delete system services ssh cipher delete system services netconf commit set system services ssh cipher set system services netconf commit Note: We might need adding/removing the configuration more than one time until the issue gets recovered.