Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to replace a Cisco ASA 5510 that died.

I have everything back up and running however when I connect to the ASA via SSH (through Putty), I receive the following warning message:

"The first cipher supported by the server is single-DES, which is below the configured warning threshold. Do you want to continue with this connection?"

I have tried to solve this by recreating the security keys with the following two commands

crypto key zeroize rsa
crypto key generate rsa noconfirm

However nothing has changed. I still receive the warning message when I connect via SSH.

share|improve this question
up vote 1 down vote accepted

Issuing the following seems to have resolved the problem. Am I correct is assuiming that I'm now using the more secure key? I never had the "ssh version 2" command running on my ASA 5510 that died on me. Perhaps there was a stronger key originally generated on it using sparks answer?

config t
ssh version 2
share|improve this answer
Specifying version 2 should also do the trick, I forgot that 1 is still supported to be honest. – sparks May 21 '09 at 15:28
Thanks, Saved me loads of time! – user284349 Apr 29 '15 at 13:17

Does your replacement ASA unit definitely have a 3DES/AES license installed? Sounds like it might not.

Have a look at and see if that's any use.

(apparently I'm not allowed to post hyperlinks, so I apologise if this suggestion isn't in the most useful format)

Cheers, jmi

share|improve this answer
Good point Jamie, and I should have clairified that yes we do have the 3DES license. – Richard West May 21 '09 at 18:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.