Not able to SSH Devices from Solarwinds Console

thangaselvi

We cant able to ssh some of the cisco devices from SolarWinds web console.

For the same device NCM backup is working with ssh and telnet for port 22 also working.

I tried to do a ssh from respective Polling engine via PowerShell , i got the error Unable to negotiate with x.x.x.x port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

After that i created a file C:\ProgramData\ssh\ssh_config and added those key , now it is working from SolarWinds polling engine via PowerShell, but not working from solarwinds console how to add these ciphers in console setting.

mr.castaneda

Hi @thangaselvi,

Here is what is happening and how to address it:

Why PowerShell works, but the Web Console doesn’t

• ssh_config only affects Windows OpenSSH: The C:\ProgramData\ssh\ssh_config file configures the native Windows OpenSSH client used by PowerShell. The SolarWinds Web Console uses an internal SSH engine that does not read Windows OpenSSH configuration files.
• Legacy KEX algorithms: The device is only offering SHA-1 key exchange methods (diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1). In modern releases of SolarWinds Observability Self-Hosted / SolarWinds Platform, deprecated SHA-1 KEX algorithms are disabled by default for security compliance.
• Why NCM still works: NCM uses its own communication engine and device templates, which retain fallback compatibility for legacy crypto to ensure config downloads don't break.

How to resolve it

• Enable modern KEX on the Cisco device (Recommended):
  The cleanest fix is to configure the Cisco switch/router to support modern key exchange algorithms (such as SHA-256). On Cisco IOS / IOS-XE:

ip ssh server algorithm kex diffie-hellman-group14-sha256

(Or include curve25519-sha256 / diffie-hellman-group16-sha512 if supported by your IOS version).

• Web Console settings:
  There is currently no setting in the Web Console UI to re-enable deprecated SHA-1 key exchange algorithms for the browser-based SSH terminal.
• Workaround for legacy hardware:
  If the device runs an older IOS image that cannot support modern KEX, you will need to continue accessing the CLI directly via PuTTY, SecureCRT, or your configured PowerShell session rather than through the web terminal.

Hope this helps point you in the right direction!