Technical Tip: How to solve server-client SSH key algorithm conflicts

When Fortimanager is configured as an SSH server for authentication, there can be some instances where server-client negotiation fails due to a mismatch in server host key algorithms. 

Below is an example of such an error received on the client:

"Failed to match parameters for server host key algorithms: client parameters=[ecdsa-sha2-nistp521, ecdsa-sha2-nistp384, ecdsa-sha2-nistp256, ssh-rsa, ssh-dss], server parameters=[rsa-sha2-512, rsa-sha2-256, ssh-ed25519]" 

Troubleshooting:

1. Check whether the correct and same SSH key parameters have been configured on both the Server and client sides.  If FortiManager is acting as a server, check the configurations using the CLI command: 'get system global'.

Sample output would be as below:

get system global

<output omitted>

ssh-hostkey-algo : ecdsa-sha2-nistp521 rsa-sha2-256 rsa-sha2-512 ssh-ed25519

<output omitted>

2. If above is successfully configured, but the issue is still appearing, try to regenerate the keys from the server side using the below commands:

execute ssh-regen-keys

This will regenerate the SSH keys as per the configurations and will solve the above conflicts on SSH Key negotiations with the client/host.