A question that I find is asked a lot in the community is:

How do I use Scrapli with legacy devices?

For example, devices (such as IOS-XE) that use the older Ciphers by default. i.e. when connecting to the device, you receive an error such as:

read : b'Unable to negotiate with port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'

What is Scrapli?

For those of you who are new to Scrapli. Scrapli is a Python library that simplifies the process of connecting and sending commands to devices via SSH. In some ways, it is very similar to Netmiko; however, rather than being pinned to use Paramiko as the underlying transport library, Scrapli gives you the flexibility to change the underlying transport library, giving you benefits such as speed and greater SSH config support.


The solution to working with the older devices within Scrapli is to:

  1. Provide ssh_config_file: True to the Scrapli context manager so that Scrapli reads the SSH config file. Full example below:
from scrapli import Scrapli

device = {
    "host": "",
    "auth_username": “user”,
    "auth_password": “password”,
    "auth_strict_key": False,
    "platform": "cisco_iosxe",
    "ssh_config_file": True <====== include

with Scrapli(**device) as conn:
    response = conn.send_command("show run")

  1. Add the required KexAlgorithms config to your .ssh/config to tell the SSH library what Ciphers to use. Like so:
$ cat .ssh/config
Host leaf2
    User lab
    KexAlgorithms +diffie-hellman-group-exchange-sha1 <=== include


  • The cipher you add to KexAlgorithms will depend on your device. Feel free to adjust it according to the error message you receive from your device.
  • You may also need to adjust the HostKeyAlgorithms within your SSH configuration. The exact configuration necessary will again depend on both the device you are attempting to connect to and the specific error messages returned.

That's all from us. I hope this helps you should you face issues around Scrapli and legacy devices.

Happy automating!

Ready to Master Network Automation? Start Your Journey Today!
Our membership provides:
  • Full deep-dive course library (inc. Batfish, pyATS, Netmiko)
  • Code repositories inc. full course code, scripts and examples
  • 24x7 multi-vendor labs (Arista, Cisco, Juniper)
  • Private online community
  • Live monthly tech sessions
  • Access to tech session library

Join Now ➜