Troubleshooting

SSH Connection Refused on a Cisco Switch

VSVipul Sir · 6 min readLast updated: 22 July 2026

SSH on Cisco IOS needs four things before it will answer: a hostname, a domain name, an RSA key of at least 768 bits, and VTY lines configured for transport input ssh with local login. Miss any one and the connection is refused.

What you see

$ ssh admin@192.168.1.1
ssh: connect to host 192.168.1.1 port 22: Connection refused

SW1(config)# crypto key generate rsa
% Please define a domain-name first.

Why it happens

The RSA key pair that SSH depends on is named after the device's fully-qualified domain name. That is why IOS refuses to generate a key until both a hostname and a domain name are set — with the defaults (Switch, no domain) there is nothing to name the key after.

Even with a valid key, the VTY lines must accept SSH. The default on many images is transport input all or telnet only, and without login local plus a local user, authentication fails immediately after the TCP connection succeeds.

How to confirm it

show ip ssh
show crypto key mypubkey rsa
show run | section line vty
show users

show ip ssh reporting "SSH Disabled" means the key was never generated. If it reports a version and timeout, the key exists and the problem is on the VTY lines or authentication.

The fix

hostname SW1
ip domain-name attila.local
!
crypto key generate rsa modulus 2048
!
username admin privilege 15 secret StrongPassword
!
line vty 0 15
 transport input ssh
 login local
!
ip ssh version 2

Use a modulus of at least 2048. SSH version 1 is insecure and should be disabled explicitly with ip ssh version 2.

How to stop it happening again

Make SSH part of your base switch template alongside hostname and management IP, and set transport input ssh so telnet is never available.

Questions people ask

Why must I set a domain name before generating keys?

The RSA key pair is labelled with the device's fully-qualified domain name. Without hostname and domain-name there is no name to give the key, so IOS refuses.

What modulus size should I use?

2048 bits. SSH version 2 requires at least 768, but 2048 is the modern minimum for anything you would call secure.

Reading the fix is not the same as doing it

Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.