Skip to main content
froslan
Staff
froslan
Staff
June 26, 2026

Troubleshooting Tip: Failed Internal I/O During SSH Credential Test After Upgrade

  • June 26, 2026
  • 0 replies
  • 13 views

Description

After upgrading FortiSIEM, the SSH credential test for devices may fail with the following 'Failed Internal I/O' error. Manual SSH testing from the FortiSIEM Collector/Supervisor also fails due to legacy SSH key exchange (KEX) and host key algorithm negotiation.

Scope

FortiSIEM.

Solution

  1. Verify SSH connectivity from the Collector/Supervisor:


Run:

ssh -l <ssh_username> <Device_IP>


If the following error is returned, continue with the following steps:

'Unable to negotiate with <Device_IP> port 22: no matching key exchange method found.

Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1.'


  1. Verify the supported Key Exchange (KEX) algorithms:


Run:

ssh -Q kex


Confirm that the following algorithms are available:

  • diffie-hellman-group-exchange-sha1.

  • diffie-hellman-group14-sha1.


  1. Force the SSH client to use the legacy KEX algorithms:


Run:

ssh -vvv -o KexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -l <ssh_username> <Device_IP>


If the connection progresses and displays:

'Unable to negotiate with <Device_IP> port 22: no matching host key type found.

Their offer: ssh-rsa.'


Continue with the next step.

  1. Update the SSH client configuration:

vi /etc/ssh/ssh_config


Add the following configuration:

Host <Device_IP>
HostKeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
KexAlgorithms +diffie-hellman-group14-sha1


Note:
If the device offers diffie-hellman-group-exchange-sha1, update the KexAlgorithms parameter accordingly.

Save the file.


  1. Verify SSH connectivity again and confirm that the SSH connection is successful:

Run:

ssh -l <ssh_username> <Device_IP>


6. From the FortiSIEM GUI, perform Test Credential for the device:

The credential test should complete successfully.


Additional Information:
If the issue persists after updating /etc/ssh/ssh_config, verify the current system crypto policy:

update-crypto-policies --show


If the device supports only legacy SSH algorithms, changing the system crypto policy may be required:

update-crypto-policies --set LEGACY


Important:
LEGACY is a system-wide crypto policy and affects all OpenSSL-based applications on the Collector/Supervisor. This workaround should be used only when required.
The recommended long-term solution is to upgrade the legacy device to support modern SSH algorithms.

    Terms & ConditionsAccessibility statement