Your Mac SSH client refuses the switch. Here is why.

Why a current SSH client walks away

Network hardware runs years behind on cryptography. An access switch on its shipped firmware offers key exchange and ciphers that current SSH clients dropped on purpose — OpenSSH, and every Mac client built on a modern crypto stack, removed SHA-1 key exchange, ssh-rsa host keys and CBC ciphers because they are weak. When the two sides have no algorithm in common there is nothing to negotiate, so the connection ends before authentication starts. That is why you never see a password prompt, and why the error talks about encryption settings rather than credentials.

Refusing is the correct default. It is just the wrong answer when the box in front of you is a switch you have to configure today and its firmware is what it is.

What lets a client reach that hardware

Noden offers the older algorithms as well — diffie-hellman-group14-sha1 key exchange, ssh-rsa host keys, aes128/192/256-ctr ciphers with HMAC-SHA-1, SHA-256 and SHA-512 (since 1.3.3). They are offered last: a modern server still negotiates curve25519, Ed25519 and AES-GCM, and the legacy set is chosen only when the device has nothing else. Your current servers are unaffected.

The algorithm list is the easy half

Four more things stop a Mac client at the door of a switch, and each one fails differently:

• Devices that announce SSH-1.99. Ruijie switches, Cisco IOS and older Comware boxes introduce themselves as SSH-1.99-…, which the standard defines as “I speak 2.0, and I also understand the older 1.x protocol”. A client that reads only the first three characters of that string sees 1.9 and walks away. Noden reads the whole version and connects (1.3.7). Genuinely obsolete protocols — SSH 1.5 — are still refused.
• Password prompts that are not the password method. Many devices ask through a question-and-answer exchange (keyboard-interactive) rather than the plain password method. Noden answers it with the saved password instead of asking you again (1.3.4).
• Packets that are not 16-byte aligned. AES-CTR is a stream cipher; plenty of devices align to 8 bytes, or send the 16-byte minimum the protocol allows. Both are legal, and both used to be rejected as unreadable. They are accepted now, with integrity still verified by the MAC (1.3.5, 1.3.6).
• “Connecting” that never ends. If a device does not finish setting up the session within 30 seconds, Noden stops waiting and says why instead of spinning (1.3.4).

When it still fails, the message names the cause — an algorithm mismatch, a refused port, a rejected password, a timeout — rather than an internal error code, and a wrong password says exactly that. The legacy path is verified end to end against a simulator that reproduces such a device: legacy key exchange, an ssh-rsa host key, AES-CTR and keyboard-interactive sign-in.

This is a compatibility measure, not a recommendation

Old algorithms exist here because the box in front of you has nothing better. If its firmware can be upgraded, upgrade it — then the modern set negotiates and none of this applies. Treat the legacy path as a way to reach a device you must configure, not as a setting to leave on your fleet.

When there is no IP address left

All of the above assumes the switch still answers on the network. When it does not — wrong VLAN, lost management address, a firewall that will not come back — the console port is the path that always answers. That is a different cable and a different guide: serial console on a Mac, including the vendor baud presets and why macOS shows every port twice.

Frequently asked

Can Noden SSH to an old Cisco, Ruijie or Comware switch?

Yes. Noden offers legacy key exchange, ssh-rsa host keys and AES-CTR ciphers when a device has nothing newer, accepts devices that announce themselves as SSH-1.99, and signs in through keyboard-interactive prompts with a saved password.

Why do other Mac SSH clients refuse my switch?

Because refusing it is deliberate. Modern clients removed SHA-1 key exchange, ssh-rsa host keys and CBC ciphers for good security reasons, and a switch that offers nothing else has no overlap left to negotiate. A stricter version check adds to it: a device announcing SSH-1.99 is claiming 2.0 support, but a client comparing only the first three characters reads it as an unsupported 1.x.

Do the legacy algorithms weaken my modern servers?

No. The older algorithms sit at the end of the offer list, so a server that supports curve25519, Ed25519 and AES-GCM negotiates exactly those, as before. The legacy set is reached only when the other end offers nothing else — and SSH 1.5, which cannot be made safe, is refused outright.

What does "no matching key exchange method found" actually mean?

It means the client and the device share no key exchange algorithm, so the session ends before authentication. It is not a password problem and not a network problem. Either the client has to offer an older method, or the device has to be upgraded to offer a newer one.

Try it against your own gear

Noden is a native macOS client for SSH, SFTP, RDP and serial console. The free version includes five saved connections of any type, which is enough to test a switch that a modern client refuses.

See also: Serial console for Mac · macOS SSH client · Best SSH client for Mac · How to use SSH on a Mac · Documentation