R3721-F3210-F3171-HP High-End Firewalls System Management and Maintenance Configuration Guide-6PW101

144
Configuring SSH2.0
Feature and hardware compatibility
Feature F1000-A-EI/S-EI F1000-E F5000 Firewall module
FIPS No No No Yes
Overview
Secure Shell (SSH) offers an approach to logging in to a remote device securely. By encryption and
strong authentication, it protects devices against attacks such as IP spoofing and plain text password
interception.
The device can not only work as an SSH server to support connections with SSH clients, but also work as
an SSH client to allow users to establish SSH connections with a remote device acting as the SSH server.
Unless otherwise noted, SSH in this document refers to SSH2.0.
The term "router" in this document refers to both routers and Layer 3 firewalls.
NOTE:
• When acting as an SSH server, the device supports SSH2.0 and SSH1. In FIPS mode, the device supports
SSH2.0 only.
• When acting as an SSH client, the device supports SSH2.0 only.
• The SSH2.0 configuration is available only at the CLI.
SSH Operation
To establish an SSH connection and communicate with each other through the connection, an SSH client
and the SSH server go through the stages listed in Table 28.
Table 28 Stages in session establish
ment and interaction between an SSH client and the server
Sta
g
es Descri
p
tion
Version negotiation SSH1 and SSH2.0 are supported. The two parties negotiate a version to use.
Key and algorithm negotiation
SSH supports multiple algorithms. The two parties negotiate algorithms for
communication, and use the DH key exchange algorithm to generate the
same session key and session ID.
Authentication
The SSH server authenticates the client in response to the client's
authentication request.
Session request After passing authentication, the client sends a session request to the server.
Interaction
After the server grants the request, the client and the server start to
communicate with each other.