Customer facing issues when attempting to establish SSH connection from a Juniper device to a Cisco device.

When attempting to establish an SSH connection to the loopback IP of a Cisco device, the following error message was observed.

labroot# run ssh [email protected] routing-instance group_internal

The authenticity of host '10.100.0.2 (10.100.0.2)' can't be established.

RSA key fingerprint is SHA256:15KPKzpHLxUXS7M4croVkSB6/TaWcQ9/HxpSr8QalQA.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '10.100.0.2' (RSA) to the list of known hosts.

ssh_dispatch_run_fatal: Connection to 10.100.0.2 port 22: invalid argument

Analyzed the router configuration and verified whether the following commands were present

set system services ssh key-exchange dh-group1-sha1 

set system services ssh hostkey-algorithm ssh-rsa

I could observe t the first command was already configured.

Customer was advised to add the second command as well, as it is required for establishing a successful SSH connection. After the key exchange is done, the client and server try to negotiate the host key algorithm, which is required to verify the identity of the server. The server offers ssh-rsa (which uses the RSA key algorithm with SHA-1), but the juniper device does not accept it

Even after adding the above command, the issue persisted.

Advised the customer to delete the known host key and verify the status. However, even after updating the host key, SSH access from the Juniper device remained unsuccessful.

Informed the customer to check the Cisco device configuration, and it was determined that the issue was caused by SSH version mismatch between the devices.

After ensuring that the SSH versions matched on both ends, the issue was resolved, and SSH access to the Cisco loopback from the MX was successfully established.