> Source: [sk165685](https://support.checkpoint.com/results/sk/sk165685)

# sk165685 - Supported SSH Traffic Ciphers 

| Property | Value |
|----------|-------|
| Solution ID | sk165685 |
| Date Created | 2020-03-10 |
| Last Modified | 2025-07-14 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

**Important:**

* Starting R81.10, there are new Clish commands. The new commands show what is supported, enable and disable ciphers: "`show ssh server cipher`" and "`set ssh server cipher`"
* The same ciphers supported in R80.40 are also supported in R81.
* To see what is supported, meaning what choices are possible, run "`# ssh -Q <option>`".
* To see what is currently configured, run "`# sshd -T -C addr=localhost`".

<br />

**In R80.40, openSSL and openSSH were upgraded. R80.40 supports the following:**   

\[Expert@ice-openipmi-main-take-1:0\]# ssh -Q cipher  
aes128-cbc  
aes192-cbc  
aes256-cbc  
rijndael-cbc@lysator.liu.se  
aes128-ctr  
aes192-ctr  
aes256-ctr  
aes128-gcm@openssh.com  
aes256-gcm@openssh.com  
chacha20-poly1305@openssh.com  

\[Expert@ice-openipmi-main-take-1:0\]# ssh -Q mac  
hmac-sha1  
hmac-sha2-256  
hmac-sha2-512  
umac-64@openssh.com  
umac-128@openssh.com  
hmac-sha1-etm@openssh.com  
hmac-sha1-96-etm@openssh.com  
hmac-sha2-256-etm@openssh.com  
hmac-sha2-512-etm@openssh.com  
hmac-md5-etm@openssh.com  
hmac-md5-96-etm@openssh.com  
umac-64-etm@openssh.com  
umac-128-etm@openssh.com  

\[Expert@ice-openipmi-main-take-1:0\]# ssh -Q key  
ssh-ed25519  
ssh-ed25519-cert-v01@openssh.com  
ssh-rsa  
ssh-dss  
ecdsa-sha2-nistp256  
ecdsa-sha2-nistp384  
ecdsa-sha2-nistp521  
ssh-rsa-cert-v01@openssh.com  
ssh-dss-cert-v01@openssh.com  
ssh-rsa-cert-v01@openssh.com  
ssh-dss-cert-v01@openssh.com  
ecdsa-sha2-nistp256-cert-v01@openssh.com  
ecdsa-sha2-nistp384-cert-v01@openssh.com  
ecdsa-sha2-nistp521-cert-v01@openssh.com  

\[Expert@ice-openipmi-main-take-1:0\]# ssh -Q kex  
diffie-hellman-group1-sha1  
diffie-hellman-group14-sha1  
diffie-hellman-group14-sha256  
diffie-hellman-group16-sha512  
diffie-hellman-group18-sha512  
diffie-hellman-group-exchange-sha1  
diffie-hellman-group-exchange-sha256  
ecdh-sha2-nistp256  
ecdh-sha2-nistp384  
ecdh-sha2-nistp521  
curve25519-sha256  
curve25519-sha256@libssh.org  

**R80.30 has the same ciphers as R80.20:**   

aes128-cbc , aes192-cbc , aes256-cbc , rijndael-cbc@lysator.liu.se  
aes128-ctr , aes192-ctr , aes256-ctr

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content