you must have has specified some ssh known hosts in ips.
ips logs into these devices via ssh and puts a shun.
#####
as idm is not able to retrieve this info.,I would look intp the service sshknownhosts from cli :
IPS-4240-Security# sh config
! ------------------------------
! Current configuration last modified Tue Sep 16 16:35:23 2008
! ------------------------------
! Version 6.1(1)
! Host:
! Realm Keys key1.0
! Signature Definition:
! Signature Update S329.0 2008-04-16
! Virus Update V1.2 2005-11-24
! ------------------------------
service interface
physical-interfaces GigabitEthernet0/0
admin-state enabled
subinterface-type none
exit
exit
! ------------------------------
service authentication
exit
! ------------------------------
service event-action-rules rules0
overrides deny-packet-inline
override-item-status Enabled
risk-rating-range 70-100
exit
exit
! ------------------------------
service host
network-settings
host-ip 192.168.16.17/25,192.168.16.1
host-name IPS-4240-Security
telnet-option enabled
access-list 0.0.0.0/0
exit
time-zone-settings
offset 330
standard-time-zone-name GMT+05:30
exit
auto-upgrade
cisco-server disabled
exit
exit
! ------------------------------
service logger
exit
! ------------------------------
service network-access
exit
! ------------------------------
service notification
exit
! ------------------------------
service signature-definition sig0
exit
! ------------------------------
service ssh-known-hosts
exit
! ------------------------------
service trusted-certificates
exit
! ------------------------------
service web-server
exit
! ------------------------------
service anomaly-detection ad0
exit
! ------------------------------
service external-product-interface
exit
! ------------------------------
service health-monitor
exit
IPS-4240-Security# conf t
IPS-4240-Security(config)# service ssh-known-hosts
IPS-4240-Security(config-ssh)# ?
default Set the value back to the system default setting.
exit Exit service configuration mode.
no Remove an entry or selection setting.
rsa1-keys SSHPv1.5 RSA public keys of known hosts
show Display system settings and/or history information.
IPS-4240-Security(config-ssh)# ?
default Set the value back to the system default setting.
exit Exit service configuration mode.
no Remove an entry or selection setting.
rsa1-keys SSHPv1.5 RSA public keys of known hosts
show Display system settings and/or history information.
IPS-4240-Security(config-ssh)# default ?
rsa1-keys Reset rsa1-keyscontents back to default.
IPS-4240-Security(config-ssh)# rsa1-keys ?
IP address of the remote host
IPS-4240-Security(config-ssh)# default
% Incomplete command
IPS-4240-Security(config-ssh)# default ?
rsa1-keys Reset rsa1-keyscontents back to default.
IPS-4240-Security(config-ssh)# default rsa1-keys ?
IP address of the remote host
IPS-4240-Security(config-ssh)#
###########
set the system default for the host ip addresses ,for which you have added the ssh keys.
Regards,
Sushil
