Enables SSH2 server to accept incoming sessions from SSH2 clients.
| access_profile | Specifies an ACL policy. |
| none | Cancels a previously configured ACL policy. |
| port | Specifies a TCP port number. The default is port 22. |
| vr_name | Specifies a virtual router
name. Note: User-created VRs are supported only on the platforms
listed for this feature in the Feature License Requirements document.
|
| all | Specifies that SSH is enabled on all virtual routers. |
| default | Specifies that SSH is enabled on the default virtual router. |
The SSH2 feature is disabled by default.
SSH2 enables the encryption of session data. You must be logged in as an administrator to enable SSH2.
SSH2 functionality is not present in the base ExtremeXOS software image, but is in an additional, installable module. Before you can access any SSH2 commands, you must install the module. Without the module, the commands do not appear on the command line. To install the module, see the instructions in Software Upgrade and Boot Options in the ExtremeXOS User Guide.
After you have installed the SSH2 module, you must generate a host key and enable SSH2. To generate an SSH2 host key, use the configure ssh2 key {pregenerated} command. To enable SSH2, use the enable ssh2 command.
Use the port option to specify a TCP port number other than the default port of 22. You can only specify ports 22 and 1024 through 65535.
You can specify a list of predefined clients that are allowed SSH2 access to the switch. To do this, you configure an ACL policy to permit or deny a specific list of IP addresses and subnet masks for the SSH port. You must create an ACL policy file before you can use the access-profile option. If the ACL policy file does not exist on the switch, the switch returns an error message indicating that the file does not exist.
Use the none option to cancel a previously configured ACL.
In the ACL policy file for SSH2, the source-address field is the only supported match condition. Any other match conditions are ignored.
Policy files can also be configured using the following command:
configure ssh2 access-profile [ access_profile | [[addrule ] [first | [[before | after]previous_rule]]] | delete rule | none ]To create an ACL policy file, use the edit policy command. For more information about creating and implementing ACL policy files, see Policy Manager and ACLs in the ExtremeXOS User Guide.
If you attempt to implement a policy that does not exist on the switch, an error message similar to the following appears:
Error: Policy /config/MyAccessProfile_2.pol does not exist on file system
If this occurs, make sure the policy you want to implement exists on the switch. To confirm the policies on the switch, use the ls command. If the policy does not exist, create the ACL policy file.
To view the status of SSH2 sessions on the switch, use the show management command. This command displays information about the switch including the enable/disable state for SSH2 sessions and whether a valid key is present.
The following command enables the SSH2 feature:
enable ssh2
The next example assumes you have already created an ACL to apply to SSH.
The following command applies the ACL MyAccessProfile_2 to SSH:
enable ssh2 access-profile MyAccessProfile_2
This command was first available in the ExtremeXOS 11.0 SSH module.
The access-profile and none options were added in ExtremeXOS 11.2.
This command is available on all platforms.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB