# Unable to Cisco IOS due to KexAlgorithms

**URL:** <https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202>\
**Category:** Ansible Project\
**Created:** [July 7, 2023, 7:06pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202 "2023-07-07T19:06:34Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bikram](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@Bikram](https://forum.ansible.com/u/Bikram)\
**Post date:** [July 7, 2023, 7:06pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/1 "2023-07-07T19:06:34Z")

</div>

Hi Team,

While I am trying to run an ansible playbook to connect to a Cisco IOS switch, it is throwing me the following error which is related to KexAlgorithms (diffie-hellman-group1-sha1).

Ansible-playbook run log:

[FinAdmin@gns-ansible playbooks]$ ansible-playbook image\_copy\_cisco\_ios.yaml --limit ‘twddxcsw04’

PLAY [Copy image file to device] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [twddxcsw04 Normalize variables] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

ok: [twddxcsw04]

TASK [Get Hardware Type of Remote Device.] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

fatal: [twddxcsw04]: FAILED! =\> {“changed”: false, “msg”: “ssh connection failed: ssh connect failed: kex error : no match for method kex algos: server [diffie-hellman-group1-sha1], client [curve25519-sha256,[curve25519-sha256@libssh.org](mailto:curve25519-sha256@libssh.org),ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1]”}

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

twddxcsw04 : ok=1 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

I tried to fix it by adding Kex Algo to ‘/etc/ssh/ssh\_config file’. After that I can ssh to the switch

[Host 10.xx.xx.\*

KexAlgorithms +diffie-hellman-group1-sha1]

SSH output:

[Admin@ gns-ansible playbooks]$ ssh user1[@](mailto:netbrain@10.16.235.12)twddxcsw04

C

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [July 8, 2023, 6:07am UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/2 "2023-07-08T06:07:08Z")

</div>

What does your inventory look like?

---

<div class="post-metadata">

**Author:** ![KB-perByte](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kb-perbyte/32/541_2.png) [@KB-perByte](https://forum.ansible.com/u/KB-perByte)\
**Post date:** [July 9, 2023, 5:25pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/3 "2023-07-09T17:25:31Z")

</div>

Hey Bikram,

Do you face a similar issue when the connection is set to libssh?  
Try using ansible\_network\_cli\_ssh\_type=libssh  
And, would you share some details of your environment, and which appliance version you are using?

Regards,

Sagar Paul

---

<div class="post-metadata">

**Author:** ![Bikram](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@Bikram](https://forum.ansible.com/u/Bikram)\
**Post date:** [July 10, 2023, 1:04pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/4 "2023-07-10T13:04:09Z")

</div>

Hi Sagar,

Yes, I tried settings ansible\_network\_cli\_ssh\_type = libssh and ansible\_network\_cli\_ssh\_type=paramiko but no success.  
I think libssh is the default ssh type for ansible.

I wanted to know if ansible supports Cisco IOS soft version: 12.2(55)SE10.

This version will not allow you to change KEX algo or any other crypto information.

Thanks  
Bikram

---

<div class="post-metadata">

**Author:** ![Bikram](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@Bikram](https://forum.ansible.com/u/Bikram)\
**Post date:** [July 10, 2023, 1:12pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/5 "2023-07-10T13:12:14Z")

</div>

Hi Dick,

Here is the sample of my inventory:

[ios]  
twddxcsw04 ansible\_host = 10.x.x.x ansible\_ssh\_user=xxxx ansible\_ssh\_pass=xxxx

Thanks  
Bikram

---

<div class="post-metadata">

**Author:** ![dbs34](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@dbs34](https://forum.ansible.com/u/dbs34)\
**Post date:** [July 10, 2023, 5:09pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/6 "2023-07-10T17:09:20Z")

</div>

I had a very similar problem that was resolved by creating a file called config under the users .ssh directory. this file contains

Host k200 hoitsw0\* hosw_0_ hoswe0\* mislxsrv stage instore central zzswm01 sysadm rvswm0\* clswm0\* cmswa0\* cmswm0\* crsw\* gwswm\*  
Ciphers +aes256-cbc,3des-cbc  
KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1  
HostKeyAlgorithms +ssh-dss

I hope that helps you!

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [July 10, 2023, 5:46pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/7 "2023-07-10T17:46:08Z")

</div>

I don’t see you setting ansible\_connection anywhere.  
According to  
[https://docs.ansible.com/ansible/latest/network/user\_guide/network\_best\_practices\_2.5.html](https://docs.ansible.com/ansible/latest/network/user_guide/network_best_practices_2.5.html) that is recommended.  
There are a bunch of other settings as well

---

<div class="post-metadata">

**Author:** ![Bikram](https://avatars.discourse-cdn.com/v4/letter/b/f04885/32.png) [@Bikram](https://forum.ansible.com/u/Bikram)\
**Post date:** [July 10, 2023, 6:12pm UTC](https://forum.ansible.com/t/unable-to-cisco-ios-due-to-kexalgorithms/38202/8 "2023-07-10T18:12:42Z")

</div>

Hi Dick,

ansible\_connection is ‘ansible.netcommon.network\_cli’ which is inside the playbook.

Thanks  
Bikram