OPERATIONAL DEFECT DATABASE
...
...
SSH connections will be rejected if the FIPS feature is enabled on release 9.3(7). This issue is similar to CSCvu10721, but SSH is also rejected for ECDSA key.
This issue applies when FIPS is enabled using the fips mode enable global configuration command on NX-OS release 9.3(7).
Downgrade to release 9.3(6) or earlier, or upgrade to release(s) 9.3(7a) or later. (This is also fixed on 10.1(1) releases and later) There is a general available SMU to address this issue on release 9.3(7): https://software.cisco.com/download/home/286314783/type/286278856/release/9.3(7) SMU installion instructions: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/system-management/b-cisco-nexus-9000-series-nx-os-system-management-configuration-guide-93x/b-cisco-nexus-9000-series-nx-os-system-management-configuration-guide-93x_chapter_010111.html
Ex. Trying to SSH into IP: 10.122.190.12 on 9.3(7). The PCB socket debug output shows the SSH connection terminating: (debug socket tcp pcb) 001 Jun 22 04:53:46.608643 netstack: syncache_socket: Created full blown socket with F:10.24.251.84.51641 L:10.122.190.12.22 peer_mss 1260 2001 Jun 22 04:53:46.608872 netstack: in_setpeeraddr: PCB: in_setpeeraddr L 10.122.190.12.22 F 10.24.251.84.51641 C: 2 2001 Jun 22 04:53:54.711153 netstack: syncache_insert: SYN added for L:10.24.251.84.51644 F:10.122.190.12.22, tp:0xf1001d94 inp:0xf1001ccc 2001 Jun 22 04:53:54.788515 netstack: in_pcbinshash: PCB: Insert pcb in hash lists L: 10.122.190.12.22, F: 0.0.0.0.0, C: 2 2001 Jun 22 04:53:54.788531 netstack: in_pcbrehash: PCB: Insert pcb in hash lists L: 10.122.190.12.22, F: 10.24.251.84.51644, C: 2 2001 Jun 22 04:53:54.788544 netstack: in_pcbconnect: PCB: Connect L:10.122.190.12.22, F:10.24.251.84.51644, C: 2 2001 Jun 22 04:53:54.788564 netstack: syncache_socket: Created full blown socket with F:10.24.251.84.51644 L:10.122.190.12.22 peer_mss 1260 2001 Jun 22 04:53:54.789166 netstack: in_setpeeraddr: PCB: in_setpeeraddr L 10.122.190.12.22 F 10.24.251.84.51644 C: 2 2001 Jun 22 04:54:00.594567 netstack: in_pcbinshash: PCB: Insert pcb in hash lists L: 10.122.190.12.22, F: 0.0.0.0.0, C: 2 2001 Jun 22 04:54:00.594581 netstack: in_pcbrehash: PCB: Insert pcb in hash lists L: 10.122.190.12.22, F: 10.24.251.84.51645, C: 2 2001 Jun 22 04:54:00.594592 netstack: in_pcbconnect: PCB: Connect L:10.122.190.12.22, F:10.24.251.84.51645, C: 2 2001 Jun 22 04:54:00.594608 netstack: syncache_socket: Created full blown socket with F:10.24.251.84.51645 L:10.122.190.12.22 peer_mss 1260 2001 Jun 22 04:54:00.594836 netstack: in_setpeeraddr: PCB: in_setpeeraddr L 10.122.190.12.22 F 10.24.251.84.51645 C: 2 2001 Jun 22 04:54:17.635373 netstack: tcp_close: 17794:tcp_close TCP: Closing connection L: 10.122.190.12.22, F: 10.24.251.84.51631 2001 Jun 22 04:54:17.635430 netstack: in_pcbremlists: PCB: Removing pcb from hash list L: 10.122.190.12.22, F: 10.24.251.84.51631 C: 2 2001 Jun 22 04:54:23.638698 netstack: tcp_close: 17794:tcp_close TCP: Closing connection L: 10.122.190.12.22, F: 10.24.251.84.51633
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
