Troubleshoot Cisco Router SSH RSA Issue

I wasn't able to remotely SSH to a Cisco router using different management jump servers. I got different error message below.

admin@server01:~$ ssh 172.27.6.1

The authenticity of host '172.27.6.1 (172.27.6.1)' can't be established.

RSA key fingerprint is SHA256:ESsfNyzjhVIYlQ/ZWDwGBeBJg6Hn1mfSO3NEW012345.

This key is not known by any other names.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '172.27.6.1' (RSA) to the list of known hosts.

ssh_dispatch_run_fatal: Connection to 172.27.6.1 port 22: incorrect signature

 

 

admin@server02~$ ssh 172.27.6.1

The authenticity of host '172.27.6.1 (172.27.6.1)' can't be established.

RSA key fingerprint is 43:03:59:93:b3:98:46:92:64:bd:8d:f7:2d:12:34:56.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '172.27.6.1' (RSA) to the list of known hosts.

RSA_public_decrypt failed: error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01

key_verify failed for server_host_key

 

I've temporary enabled Telnet and regenerated (zeroise) the SSH/RSA key. Make sure domain name is configured.

Router#show ip ssh

SSH Enabled - version 1.99

Authentication methods:publickey,keyboard-interactive,password

Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa

Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa

Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

MAC Algorithms:hmac-sha1,hmac-sha1-96

Authentication timeout: 120 secs; Authentication retries: 3

Minimum expected Diffie Hellman key size : 1024 bits

IOS Keys in SECSH format(ssh-rsa, base64 encoded): CISCO_IDEVID_SUDI

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGzzxJCzuFj/sHvJuZA4fzhV6t6XHDR73aCPNZZxoD

5iuUp8pu14OAV5L+Zu+EL6QZqV88bcmRvSYp05JmLrGmlBv4QAJluyla85PnZurC4OBxSxWg/gx40mzJ

yWeHnlQd1euxbo0J0+gkwLQYWmrsgGLpfqhXKDAUVCzhPdpjRdUT3wg2Cbk49YSr+LntrPwBVBRF7dEl

p1mGs2ykL0LDmU6rlWf9O1aRsUYmFhgK16pFekFGluKmrdaoak5sfk9ch38rr5O8rejcsjp408PyeJrS

jgB3sVTBpywcG39LtmLaku5xQrGfjlowyBOyRaLRgbjZDvdfl7aqHP12345

 

Router#show run | inc domain

no ip domain lookup

ip domain name local.com

 

I initially removed the SSH/RSA key and configured the basic rsa key without using a label but still couldn't SSH.

Router(config)#crypto key zeroize

% All keys will be removed.

% All router certs issued using these keys will also be removed.

Do you really want to remove these keys? [yes/no]: yes

 

Router(config)#crypto key generate rsa modulus 2048

The name for the keys will be: Router.local.com

 

% The key modulus size is 2048 bits

% Generating 2048 bit RSA keys, keys will be non-exportable...

[OK] (elapsed time was 0 seconds) 

 

I've zerioise the SSH key again and this time used a label and keypair-name. I was able to SSH to the router afterwards.

Router(config)#crypto key zeroize

% All keys will be removed.

% All router certs issued using these keys will also be removed.

Do you really want to remove these keys? [yes/no]: yes

Router(config)#

Router(config)#crypto key generate rsa mod 2048 label Router.local.com

The name for the keys will be: Router.local.com

 

% The key modulus size is 2048 bits

% Generating 2048 bit RSA keys, keys will be non-exportable...

[OK] (elapsed time was 2 seconds)

 

Router(config)#ip ssh rsa keypair-name Router.local.com

Router(config)# end

Router#write memory

Building configuration...

[OK]