If SSH fails on a Cisco Catalyst 9200, 9200L, 9300, 9300L, or 9500, start with the exact error message rather than changing the entire configuration. The fastest troubleshooting path is to check management reachability, SSH service status, RSA keys, VTY settings, authentication, and access restrictions in that order.
This guide focuses on SSH failures after configuration, an IOS XE upgrade, or a management-network change. It does not replace a basic Cisco SSH setup guide, and Catalyst 1300 switches should not be diagnosed with the same IOS XE command sequence.
Start With the Error Message
The exact client message helps determine where to start. A timeout, a refused connection, and an authentication failure occur at different stages of the SSH process.
| Client message | What it usually means | First checks |
|---|---|---|
| Connection refused | The host is reachable, but TCP port 22 is not accepting the session. | SSH status, RSA keys, VTY transport |
| Connection timed out | The client cannot complete the path to the management interface. | VLAN, routing, VRF, ACL, firewall |
| No route to host | The client has no usable route to the destination. | Default gateway, routing table, management subnet |
| Permission denied | The SSH service responds, but authentication fails. | Username, AAA, password, login method |
| Host key or cipher error | The client and switch cannot agree on SSH parameters. | IOS XE release, SSH version, client algorithms |
A switch can respond to Ping while still refusing SSH. Ping only confirms that some IP traffic reaches the device; it does not prove that the SSH server is enabled or that TCP port 22 is permitted.
Confirm the Management Path Before Changing SSH
When the error is a timeout, start with the management path rather than regenerating keys. Check whether the management SVI or management interface is configured correctly and operational.
- Is the management SVI or management interface using the expected IP address?
- Is the interface operational?
- Is the client in the correct management VLAN?
- Is the default gateway or route available?
- Is the switch using a management VRF?
- Is TCP port 22 blocked by an upstream firewall or ACL?
- Is the client connecting to the correct address?
Use the following commands from the console or another working management session:
The management interface should have the expected address and an operational state. If the SVI is down, checking RSA keys or VTY lines will not solve the problem.
For a client in another subnet, verify the complete path in both directions. A firewall may allow ICMP while blocking TCP/22, which can produce a successful Ping but an SSH timeout.
Check the SSH Service and RSA Keys
After confirming reachability, check the SSH service itself:
The show ip ssh command displays the SSH version and parameters such as the authentication timeout and retry count. The show ssh command displays active SSH server connections.
A message indicating that no SSH sessions are currently running does not necessarily mean that SSH is disabled. It may simply mean that no session is active at that moment. Use show ip ssh to check the service status and version.
If SSH is disabled, check whether the device has a usable RSA key pair. Cisco states that RSA key generation is required for an IOS XE SSH server. The current Cisco Secure Shell Configuration Guide also explains SSH version selection and RSA key requirements.
A basic IOS XE reference configuration may include:
This is a troubleshooting reference, not a universal copy-and-paste configuration. The exact key size, authentication model, and command syntax should match the switch model, IOS XE release, and security policy.
Verify VTY and Authentication Settings
If the SSH service is enabled but the client still receives Connection refused or is disconnected immediately, inspect the VTY configuration:
A local-authentication example may look like this:
If the VTY lines allow only Telnet, or do not permit SSH, the switch may reject SSH even though the management IP is reachable.
Common Authentication Problems
- RSA keys were never generated.
ip ssh version 2is missing or does not match the client.- The VTY lines do not permit SSH.
login localis missing when local authentication is intended.- The configured username is absent or has the wrong privilege.
- An AAA server is unavailable.
- A VTY access-class blocks the client source address.
Also check whether an access-class is applied to the VTY lines:
A VTY access-class can allow only specific source subnets or management hosts. This can create a situation where SSH works from one network but fails from another.
If the switch uses centralized AAA, verify the authentication method and the reachability of the TACACS+ or RADIUS servers before changing the local username configuration. Replacing AAA settings during an outage can remove the remaining working access path.
Troubleshoot SSH After an IOS XE Upgrade
An IOS XE upgrade does not always mean that the SSH configuration has been removed. However, an upgrade can expose differences in keys, algorithms, management interfaces, VRFs, AAA behavior, or inherited configuration.
Compare the pre-upgrade and post-upgrade outputs for:
Post-Upgrade Checks
- Confirm that the management IP is still configured on the expected interface.
- Confirm that the RSA host key still exists.
- Confirm that SSH version 2 is enabled.
- Confirm that the VTY lines still permit SSH.
- Confirm that the AAA method list and server reachability are unchanged.
- Check whether the client rejects the switch because of an unsupported key exchange, cipher, or host-key algorithm.
- Confirm that the client is using the correct management VRF when one is configured.
Avoid assuming that the upgrade itself is the root cause. Compare the actual configuration and client error before making changes.
Catalyst 9200, 9300, 9500, and C1300 Scope
This troubleshooting approach is intended for Cisco Catalyst platforms running IOS XE, including C9200-24P-E, C9200-48P-E, C9200L access switches, C9300 and C9300L switches, C9500-16X, and C9500-24Y4C.
The physical role of the switch does not change the basic troubleshooting sequence, but the available management interfaces, VRF design, software release, and platform-specific commands can differ.
Catalyst 1300 Is a Separate Case
Do not directly apply the IOS XE commands in this guide to the Cisco Catalyst 1300. The Catalyst 1300 uses a different software and management design, with Web UI and platform-specific CLI behavior.
If the device is a C1300, first confirm the exact model and software interface. Use the corresponding Catalyst 1300 administration and CLI documentation instead of assuming that commands for the C9200 or C9300 will apply.
Information to Send for a Configuration Review
If the issue cannot be resolved locally, prepare the following information:
- Exact switch model and SKU
- IOS XE version
- Error message from the SSH client
- Source IP address and destination management IP
- Whether Ping succeeds
- Output from
show ip ssh - Output from
show ssh - Output from the VTY configuration
- Management interface or SVI status
- Whether the switch uses AAA or a management VRF
- Whether the problem started after an upgrade or configuration change
Send the model, IOS XE version, error message, and command output for review.
Frequently Asked Questions
It usually means that the destination IP is reachable, but the SSH connection is not being accepted. Check show ip ssh, RSA keys, VTY transport settings, and access restrictions.
A timeout usually indicates that the client cannot complete the management path. Connection refused usually indicates that the host was reached but no SSH service accepted the TCP connection. Investigate the two errors separately.
Run show ip ssh from the console or another working management session. The output should identify the enabled SSH version and authentication parameters when the service is active.
It allows SSH connections on the selected VTY lines. It does not replace the need for a reachable management IP, RSA keys, authentication, or suitable VTY access restrictions.
Possible causes include a changed management interface, missing or changed RSA keys, VTY configuration differences, AAA changes, VRF changes, or incompatibility between the new SSH parameters and the client. Compare the configuration and client error before changing the switch.
Not directly. Catalyst 1300 uses a different platform and management model. Use its specific administration and CLI documentation instead of assuming that IOS XE commands apply.
Final Takeaway
SSH troubleshooting becomes faster when the error message is treated as a diagnostic clue rather than a generic configuration failure.
Start with the management path for a timeout. Check the SSH service, RSA keys, and VTY lines for a refused connection. Check usernames, AAA, and access restrictions when the switch presents an authentication prompt but rejects the login.
For a configuration-specific review, send the exact model, IOS XE version, client error, and relevant command output through the Cisco switch inquiry page.