topic Re: ssh connection problem on ASA management interface in Network Security

ssh connection problem on ASA management interface

Alex Ribas — Fri, 26 Mar 2021 16:30:19 GMT

Here is part of the config:

new firewall (without config )

Just Ip management

ASA Version 9.15(1)1

ssh stricthostkeycheck
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group14-sha1
ssh 0.0.0.0 0.0.0.0 mgmt

!
interface Management1/1
management-only
nameif mgmt
security-level 0
ip address 172.29.100.71 255.255.255.0

Source (PING etc )

ping 172.29.100.71
PING 172.29.100.71 (172.29.100.71) 56(84) bytes of data.
64 bytes from 172.29.100.71: icmp_seq=1 ttl=254 time=0.461 ms
64 bytes from 172.29.100.71: icmp_seq=2 ttl=254 time=0.672 ms
64 bytes from 172.29.100.71: icmp_seq=3 ttl=254 time=0.520 ms
^C64 bytes from 172.29.100.71: icmp_seq=4 ttl=254 time=0.590 ms

ssh -l xxxxx 172.29.100.71
Connection closed by 172.29.100.71

sh ssh
Idle Timeout: 5 minutes
Version allowed: 2
Cipher encryption algorithms enabled: aes256-ctr aes256-cbc aes192-ctr aes192-cbc aes128-ctr aes128-cbc
Cipher integrity algorithms enabled: hmac-sha2-256

Hosts allowed to ssh into the system:
0.0.0.0 0.0.0.0 mgmt
FW04#

What am I missing?

Re: ssh connection problem on ASA management interface

Rob Ingram — Fri, 26 Mar 2021 16:33:57 GMT

Hi @Alex Ribas

Have you run generated an RSA key pair? If not run "crypto key generate rsa modulus 2048"

Re: ssh connection problem on ASA management interface

Alex Ribas — Fri, 26 Mar 2021 16:35:50 GMT

Yes I did

crypto key generate rsa general-keys modulus 2048
WARNING: You have a RSA keypair already defined named <Default-RSA-Key>.

Many times

Re: ssh connection problem on ASA management interface

Alex Ribas — Fri, 26 Mar 2021 16:48:51 GMT

crypto key generate rsa modulus 2048
INFO: The name for the keys will be: <Default-RSA-Key>
Keypair generation process begin. Please wait...
FW04(config)#

Re: ssh connection problem on ASA management interface

chadbaird2431 — Fri, 26 Mar 2021 16:54:11 GMT

The ASA is possibly missing a route back to the network that you're accessing the ASA on. I'd check that.

Type in show management-access.. if it returns nothing then use: management-access management (to manage from management interface) or the interface might be shut down.

Re: ssh connection problem on ASA management interface

Alex Ribas — Fri, 26 Mar 2021 17:14:11 GMT

I Think this is issue

ssh admfw@172.29.100.71
The authenticity of host '172.29.100.71 (172.29.100.71)' can't be established.
RSA1 key fingerprint is 6b:00:4f:d4:6f:fe:53:8a:48:49:60:28:08:7c:64:8c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.29.100.71' (RSA1) to the list of known hosts.
Selected cipher type <unknown> not supported by server

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 150 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Disabled perpetual
Security Contexts : 2 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 300 perpetual
Total VPN Peers : 300 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total TLS Proxy Sessions : 1000 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Disabled perpetual
VPN Load Balancing : Enabled perpetual

Serial Number: xxxxxxxxxxx
Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
Configuration register is 0x1
Image type : Release
Key Version : A

FW04(config)# sh ssh
Idle Timeout: 5 minutes
Versions allowed: 1 and 2
Cipher encryption algorithms enabled: aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr
Cipher integrity algorithms enabled: hmac-sha1 hmac-sha1-96

Re: ssh connection problem on ASA management interface

Rob Ingram — Fri, 26 Mar 2021 17:22:09 GMT

@Alex Ribas

Encryption-3DES-AES : Disabled

You don't have the 3DES license so you cannot SSH to the ASA. You'll need to go https://software.cisco.com/software/swift/lrp/#/pak and request an activation key (free).

Re: ssh connection problem on ASA management interface

pjweintraub0206 — Fri, 07 May 2021 17:16:09 GMT

I am assuming you also created a local username:

add these 2 commands:

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

Re: ssh connection problem on ASA management interface

Maurizio Caloro — Mon, 10 May 2021 08:36:26 GMT

crypto key zeroize rsa
crypto key generate rsa modulus 2048

username ssh password
ssh 172.29.100.0 255.255.255.0 mgmt

regards

Mauri