topic Hi devils_advocate,Take a in Switching

Unable to SSH switch due to no exec timeout set

chrismalone07 — Fri, 08 Mar 2019 09:53:51 GMT

Hi, it looks as though someone as set no exec timeout on the VTY lines of a remote switch. We are unable to connect to this now via SSH even though it is up and running. Looking at the configuration backups I can see that the no exec timeout command has been set on the VTY lines. We don't have any IT presence on site at the moment and it looks as though the reason that we can't log on is due to idle users sessions using up all of the lines, would be my guess.

Does any one know of a way we can remotely clear these sessions without having to console onto this device or if this is in fact what is most likely the problem?

If you're not able to get a

John Blakley — Tue, 22 Sep 2015 10:44:18 GMT

If you're not able to get a connection at all (your window pops up and then goes away - in the case of using putty), I'd venture to guess that it's due to the lines being taken up. No exec-timeout shouldn't have any effect on you being able to get into the device. There's no way that I know of to remotely clear them without being able to get into the device aside from rebooting it...

HTH,

John

Hi,Do you have SNMP Read

Steve Fuller — Tue, 22 Sep 2015 10:48:15 GMT

Hi,

Do you have SNMP Read-Write access? If so then follow the procedure in How to Detect and Clear Hung TCP Connections using SNMP.

Regards

Hi Steve, Thanks for your

chrismalone07 — Tue, 22 Sep 2015 11:07:51 GMT

Hi Steve,

Thanks for your reply. We have SNMP R/W access, however, do I need to install Perl in order to run this clear TCP session command?

Hi,

Steve Fuller — Tue, 22 Sep 2015 12:15:41 GMT

Hi,

You don't need Perl. As long as you have a host with snmpwalk and snmpset you should be OK. The process is essentially the following:

snmpget -c <rw_community> <device_name> .1.3.6.1.4.1.9.9.6.1.1.1.9

This will return a value that is the concatenation of the destination and source IP address and TCP ports. For example:

CISCO-SMI::ciscoMgmt.6.1.1.9.D.D.D.D.22.S.S.S.S.60239 = INTEGER: 376

In the above D.D.D.D is the destination IP address and S.S.S.S is the source IP address. The 22 is the destination TCP port (SSH in this case) and 60239 is the source TCP port.

You then run snmpset against the tcpConnState OID (.1.3.6.1.2.1.6.13.1.1) with the value from the snmpwalk concatenated. For example:

snmpset –c <rw_community> <device> .1.3.6.1.2.1.6.13.1.1.D.D.D.D.22.S.S.S.S.60239 integer deleteTCB

Regards

A reboot or a console would

devils_advocate — Tue, 22 Sep 2015 13:45:06 GMT

A reboot or a console would be the only thing I can think of.

Hi devils_advocate,Take a

Steve Fuller — Tue, 22 Sep 2015 13:53:44 GMT

Hi devils_advocate,

Take a read of How to Detect and Clear Hung TCP Connections using SNMP that I posted earlier. It shows how to clear VTY sessons using SNMP, which I summarised in a later response.

Regards