Skip to main content
jjdope
Staff
jjdope
Staff
March 18, 2026

Technical Tip: SSH key exchange failure between FortiGate v7.0 and FortiAP v7.6.3: 'No Matching Key Exchange Method Found'

  • March 18, 2026
  • 0 replies
  • 547 views
Description This article describes why the error 'no matching key exchange method found' occurs when attempting SSH access from a FortiGate to a FortiAP, and how to resolve it.
Scope FortiGate v7.0, FortiAP v7.6.3.
Solution

When a FortiGate running FortiOS v7.0 attempts SSH access to a FortiAP running version 7.6.3, the following error is observed:

Unable to negotiate with 1.1.1.1: no matching key exchange method found.

Their offer: diffie-hellman-group14-sha256,

diffie-hellman-group16-sha512,

kexguess2@matt.ucc.asn.au,

kex-strict-s-v00@openssh.com

 

The error indicates the SSH server (FortiAP) did not offer any key exchange algorithm supported by the SSH client (FortiGate), causing the SSH access attempt to fail.

In FortiAP v7.6.3, the curve25519-based Diffie-Hellman algorithms are removed in FIPS mode and non-FIPS mode. This is not compatible with the FortiOS v7.0 SSH client, which primarily uses curve25519-based key exchange algorithms.

 

 

Resolution:

Upgrade the FortiGate to v7.2 or later.

Alternatively, upgrade the FortiAP to v7.6.4 or later.  Starting in this version, the curve25519 key exchange algorithms are supported unless the FortiAP is running in FIPS mode. By default, FIPS mode is disabled.

 

Note: If required, a FortiAP with FIPS mode enabled can have this mode disabled by resetting the FortiAP to factory settings, see FortiAP CLI configuration and diagnostics commands.

 

    Terms & ConditionsAccessibility statement