Cisco `ip ssh source-interface` refers to server, client, or both

ciscocisco-commandsssh

If I do ip ssh source-interface g0, that restricts:

  1. which interface the Cisco device listens for SSH connections,
  2. which interface it is allowed to use for the client to connect to other SSH servers,
  3. which interface all SSH packets go out and/or permitted in (implying both 1 and 2), or
  4. None of the above.

Experimentally, it looks like 2, which is not what I had intuited originally, thus prompting the question for confirmation.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-i3.html#wp5893687220 — Ref that seems to agree with my experimental conclusion, but I've been wrong trying to follow Cisco logic before.

Best Answer

Actually, none of the above. It doesn't actually determine any interface. That command, and other Cisco source commands, determine the source address on the traffic sourced on the device exiting the device, regardless of the actual interface used to forward the traffic. Remember that traffic is routed by the destination address.

Without any command, the source address on the traffic sourced from the device leaving the device would be the actual interface used, but the Cisco source commands can be used to change the source address to the address of a different interface on the router. Loopback interfaces are a good choice because loopback addresses never go down, unless you specifically configure them down.

For example, you have a router with Loopback0, GigbitEthernet0, GigbitEthernet1, and GigbitEthernet2. You probably want all traffic sourced from Loopback0 so that it doesn't matter which interface is used. That way, if the traffic would normally use GigbitEthernet0, but that interface goes down and the other device could still reach the router through GigbitEthernet2, then the conversation can continue normally because the source address remains the same.

Related Topic