set kex-algorithms <default | all | {kex} [{kex}...]>
Parameters
Parameter
Description
Possible values
Default value
<kex>
diffie-hellman-group14-sha1,
diffie-hellman-group-exchange-sha1,
diffie-hellman-group-exchange-sha256,
all
default
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
For the ssh-client-configuration context, the default values are:
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group14-sha1
For the ssh-server-configuration context, the default values are:
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
Description
Set SSH client's key exchange (kex) algorithms.
If an SCP transfer for a gateway in FIPS mode returns the following error:
server offered non-Approved DH group
You must adjust the key exchange list for the ssh-client-configuration context so that it does not contain diffie-hellman-group-exchange-sha1 or diffie-hellman-group-exchange-sha256.
Context
ssh-client-configuration
User level
admin
Examples
# set kex-algorithms diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 KexAlgorithms: diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 # set kex-algorithms default KexAlgorithms: diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256# set kex-algorithms all KexAlgorithms: diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256
