Does 3650 Mgmt Interface (Gi0/0) support SSH ?

Question

Does anyone know if the WS-C3650-48PD supports (or not) SSH over the MGMT interface (Gi0/0) ?
I have it working with Telnet and the switch is configured with SSH enabled.
I can use SSH if I use in-band management (configure the switch IP on a VLAN interface instead of on the Gi0/0 interface), but when I try to open a SSH session over the MGMT interface I get "Connection refused" in my SSH client.
Is there something extra I need to do to make SSH work over MGMT ?
vrf definition Mgmt-vrf
 address-family ipv4
 exit-address-family
 address-family ipv6
 exit-address-family
ip ssh time-out 60
ip ssh authentication-retries 5
ip ssh logging events
ip ssh version 2
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 ip address 172.28.26.95 255.255.255.0
 negotiation auto
ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 172.28.26.1
line vty 0 4
 access-class 1 in
 exec-timeout 50 0
 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 logging synchronous
 login local
 length 0
 transport input telnet ssh
 escape-character 3
Normally I would  use "transport input ssh" - ie. no telnet - but this is the only way I've been able to use the MGMT interface so far and I'd rather not be using Telnet at all.
Thanks
David

Answer 1

Quicker than expected - quiet morning so far ;-)
#sh ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 5
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxxxxxxx...
I checked the SSH traffic from my client - I send SYN, get back RST - definitely an active refusal of the connection.
If MGMT Gi0/0 does support SSH, it's clear I'm missing something to enable it.
IOS is Cisco's current recommended for this platform and in the recommended installation mode
Switch Ports Model              SW Version        SW Image              Mode
*    1 52    WS-C3650-48PD      03.03.05SE        cat3k_caa-universalk9 INSTALL
If I move the management IP address off Gi0/0 and onto the management VLAN interface (management is then through Gi1/1/1 where the VLAN is trunked), it works fine and I can SSH to the switch with no other changes to the configuration (of course subsequently I want to disable Telnet)
I know can eliminate patching and routing/forwarding of the traffic as issues given Telnet and PING can reach the management IP address under both configurations. It's as if the MGMT interface just doesn't allow SSH by default (or possibly not at all)
If you have a working configuration you'd be happy to share, I'd appreciate it.
Thanks again
David