# Manual SSH connection works, via Ansible fails (used to work) **URL:** \ **Category:** Get Help\ **Tags:** ios, cisco, ssh, network\ **Created:** [September 12, 2025, 3:30pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476 "2025-09-12T15:30:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![toasttheft](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@toasttheft](https://forum.ansible.com/u/toasttheft)\ **Post date:** [September 12, 2025, 3:30pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/1 "2025-09-12T15:30:34Z")
I’ve been using ansible to configure a catalyst 1000 switch for the last few months. Tday I’ve attempted to `--check --diff` the switch config, only for ansible to return an error about the kex algorithms. This was an issue to begin with and I added the required config to my `.ssh/config`. I can still manually connect to the switch using `ssh `: it uses the config and connects fine… so I’m confused why this is no-longer working via Ansible. Can anyone give my any pointers? Output error section: ```auto The full traceback is: File "/home/username/repos/ansible/venv/lib/python3.13/site-packages/ansible_collections/ansible/netcommon/plugins/module_utils/network/common/network.py", line 218, in get_capabilities capabilities = Connection(module._socket_path).get_capabilities() File "/home/username/repos/ansible/venv/lib/python3.13/site-packages/ansible/module_utils/connection.py", line 183, in __rpc__ raise ConnectionError(to_text(msg, errors='surrogate_then_replace'), code=code) fatal: [catalyst1000]: FAILED! => { "changed": false, "invocation": { "module_args": { "available_network_resources": false, "gather_network_resources": null, "gather_subset": [ "min" ] } }, "msg": "ssh connection failed: ssh connect failed: kex error : no match for method kex algos: server [diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1], client [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256]" } PLAY RECAP *********************************************************************************************************************************************************************************** catalyst1000 : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 ``` ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [September 12, 2025, 7:08pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/2 "2025-09-12T19:08:03Z")
If you read the error, this is about the ssh configuration ```auto kex error : no match for method kex algos: ``` it cannot match the configured key algorithms on the server server (target machine) ```auto server [diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1], ``` and the client (ansible machine), which is using a much stronger list ```auto client [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256] ``` To see exactly how ansible executes ssh and sets the config, use `-vvv`, but just adding the configuration for those targets to include the weaker keys should be enough (assuming you cannot change the configuration on the ssh server). [ansible.builtin.ssh connection – connect via SSH client binary — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/ssh_connection.html#parameter-ssh_common_args) ---
**Author:** ![toasttheft](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@toasttheft](https://forum.ansible.com/u/toasttheft)\ **Post date:** [September 14, 2025, 2:05pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/3 "2025-09-14T14:05:41Z")
Yes, I’ve read the error about algorithm mismatch. I have the config in my `.ssh/config` file that specifies the (poor) algorithms that the switch will accept. I’ve been using this config to connect directly/manually and via Ansible for months. However, it isn’t working any longer. I can’t see anything in the verbose output that states that the `.ssh/config` file is being sourced, though I’m not sure if I should. I’m not sure how to debug this, so any pointers would be appreciated. ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [September 14, 2025, 2:25pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/4 "2025-09-14T14:25:02Z")
You seem to be connecting to some network device, so you should first find out which connection plugin you are using to do that. ansible.netcommon is mentioned in the stacktrace, so it’s likely not ansible-core’s builtin SSH connection plugin. Also you likely updated something between the last day that connecting worked, and when it no longer worked. My guess is that you updated ansible-core and/or some of the involved collections, like ansible.netcommon and probably a network device specific collection. Looking at the changelogs / porting guides could help as well. ---
**Author:** ![toasttheft](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@toasttheft](https://forum.ansible.com/u/toasttheft)\ **Post date:** [September 14, 2025, 3:27pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/5 "2025-09-14T15:27:58Z")
Great, thanks. I’ll go educate myself, and come back if I’m scratching my head 😉 ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [September 15, 2025, 2:45pm UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/6 "2025-09-15T14:45:15Z")
Note that ansible itself will not source `.ssh/config`, the ssh plugin uses the `ssh` command line and that tool does it’s own sourcing of configuration, the same happens with paramiko(deprecated) and libssh based netcommon plugins, they rely on their dependencies to handle the ssh configuration sourcing. ---
**Author:** ![toasttheft](https://avatars.discourse-cdn.com/v4/letter/t/7cd45c/32.png) [@toasttheft](https://forum.ansible.com/u/toasttheft)\ **Post date:** [September 18, 2025, 7:27am UTC](https://forum.ansible.com/t/manual-ssh-connection-works-via-ansible-fails-used-to-work/44476/7 "2025-09-18T07:27:49Z")
This was a total error on my part. The hostname in my `inventory.yaml` and my `.ssh/config` no longer matched. I’ve aligned them, and now it works as expected. Thanks for the help all.