Multiple SSH listening ports on Catalyst switches

[diondohmen]

Hi community,

On Cisco Routers you have the option to configure multiple SSH ports (instead of the default tcp 22) in combination with rotary groups. Then, attach these rotary groups to specific VTY lines.This works just fine.

But, it seems on Cisco switches, you can not define different SSH ports. The command Router(config)#ip ssh port portnum rotary group is not available. You can use the rotary statement on the VTY lines, but this works only for Telnet connections.

Does anyone know, if it's possible to use the rotary groups on switches with SSH? The goal which I am trying to achieve is, I want to use multiple AAA method lists, and define these under specific VTY lines. That way, I am able to designate specific users, connecting from specific IP addresses, on a dedicated VTY line, with a custom AAA method list.

Any help is much appreciated!

Kind regards,

Dion Dohmen

[nehmaan123]

Hi,

What's the switch and does it support the crypto feature SSH ?

Here is my configuration:

ip ssh port 2001 rotary 1 2

line vty 1
 access-class 99 in
 ipv6 access-class MANAGEMENT in
 logging synchronous
 rotary 1
 transport input ssh

line vty 2
 access-class 99 in
 ipv6 access-class MANAGEMENT in
 logging synchronous
 rotary 2
 transport input ssh

root@XXX:~# ssh user1@192.168.0.X -p 2001
Password:

root@XXX:~# ssh user2@192.168.0.X -p 2002
Password:

SW1#show tcp brief
TCB       Local Address           Foreign Address        (state)
061D397C  192.168.0.X.2001      192.168.0.X.35351    ESTAB
05D5070C  192.168.0.X.22          192.168.0.X.51502     ESTAB
061C5C6C  192.168.0.X.2002      192.168.0.X.49720    ESTAB
SW1#

Thanks,

Nehmaan

[diondohmen]

Thanks for your response!

For example; a 3750:

Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(55)SE1, RELEASE SOFTWARE (fc1)

I am already using SSH on this one, but the "ip ssh port" statement is not available:

TESTSWITCH(config)#ip ssh ?
  authentication-retries  Specify number of authentication retries
  dscp                    IP DSCP value for SSH traffic
  logging                 Configure logging for SSH
  precedence              IP Precedence value for SSH traffic
  source-interface        Specify interface for source address in SSH
                          connections
  time-out                Specify SSH time-out interval
  version                 Specify protocol version supported

Which type of switch are you using? Maybe it's available as of a particular software version and higher...

[nehmaan123 · Accepted solution]

Hi,

I am currently using 12.2(58)SE2 on the 3560.

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

I downgraded my IOS to check if it's still supported for the 3560 on 12.2(55)SE1 and it's not.

XXX uptime is 1 minute
System returned to ROM by power-on
System restarted at 14:38:50 GMT Tue Jul 29 2014
System image file is "flash:/c3560-ipservicesk9-mz.122-55.SE1.bin"

XXX(config)#ip ssh ?
  authentication-retries  Specify number of authentication retries
  dscp                    IP DSCP value for SSH traffic
  logging                 Configure logging for SSH
  precedence              IP Precedence value for SSH traffic
  source-interface        Specify interface for source address in SSH
                          connections
  time-out                Specify SSH time-out interval
  version                 Specify protocol version supported

XXX(config)#ip ssh

I then upgraded to 12.2(55)SE9 and it's still not supported.

XXX uptime is 1 minute
System returned to ROM by power-on
System restarted at 14:47:49 GMT Tue Jul 29 2014
System image file is "flash:/c3560-ipservicesk9-mz.122-55.SE9.bin"

XXX(config)#ip ssh ?
  authentication-retries  Specify number of authentication retries
  dscp                    IP DSCP value for SSH traffic
  logging                 Configure logging for SSH
  precedence              IP Precedence value for SSH traffic
  source-interface        Specify interface for source address in SSH
                          connections
  time-out                Specify SSH time-out interval
  version                 Specify protocol version supported

XXX(config)#ip ssh

I would recommend that you upgrade but I don't see any point unfortunately.

Thanks,

Nehmaan

[diondohmen]

Thank you very much for testing!

Seems that 12.2(58) is the first release that supports the "ip ssh port" statement!

Strange though, because .58 has already been released in 2011, en the latest 12.2(55) has still been updated a few months ago..

[nehmaan123]

Hi,

That's no problem. Nothing like providing support on your day off work. :-)

Yep seems very strange. Unfortunately 12.2(58) is not supported on your 3750. The latest is the 3750x which runs on IOS-XE.

All the best,

Nehmaan

[diondohmen]

..