ip ssh retries...interpretation question

I'm working on a task to configure SSH and my requirement is this:

"The users can only retry 2 times when the wrong credentials are used,
and the timeout should be exactly 1 minute."

So my question is about the term retries. Should I make it where they
get 3 total login attempts (1 initial connection and 2 retries) or 2
total login attempts (initial login attempt and 1 retry)?

The command: ip ssh authentication-retries 2 allows a total of 3 login attempts.
The command: ip ssh authentication-retries 1 allows a total of 2 login attempts.

Which one is correct in this instance?

-Marc

Blogs and organic groups at http://www.ccie.net
Received on Sun Aug 28 2011 - 10:26:46 ART