topic Re: hi,you should be in global in Network Security

ASA 5505 ssh access question

yliu000011 — Tue, 12 Mar 2019 05:50:33 GMT

Hi,

Currently any ip address can ssh to my asa 5505 firewall outside interface. What should I do to restrict only certain IP can? What's the command to see the current ssh management access rule?

Thanks.

hi,try to issue a show run

johnlloyd_13 — Mon, 27 Apr 2015 03:39:02 GMT

hi,

try to issue a show run ssh.

you can restrict by using the ssh command such as below:

ssh <IP SUBNET> <SUBNET MASK> <INTERFACE>

ssh 1.1.1.0 255.255.255.0 outside

ssh 1.1.1.50 255.255.255.255 outside

I tried this and got an error

yliu000011 — Mon, 27 Apr 2015 03:58:42 GMT

I tried this and got an error. Please help.

CL-T179-12IH# ssh 162.221.204.59 255.255.255.255 outside
^
ERROR: % Invalid input detected at '^' marker.

Also when I do "show run ssh" I see below line. How to remove it?

ssh 0.0.0.0 0.0.0.0 outside

Thanks.

hi,you should be in global

johnlloyd_13 — Mon, 27 Apr 2015 04:03:39 GMT

hi,

you should be in global config mode in order to add the SSH line:

CL-T179-12IH# conf t

CL-T179-12IH(config)# ssh 162.221.204.59 255.255.255.255 outside

put a 'no' in order to negate a line and a issue a write memory to save your config.

CL-T179-12IH(config)# no ssh 0.0.0.0 0.0.0.0 outside

Thanks a lot. Ye

yliu000011 — Mon, 27 Apr 2015 04:19:10 GMT

Thanks a lot.

Re: hi,you should be in global

Brahim O — Wed, 21 Sep 2022 02:29:32 GMT

After hours googling on how to allow only 1 IP for SSH access on ASA firewall on Packet Tracer, you saved my life !!

CL-T179-12IH(config)# ssh 162.221.204.59 255.255.255.255 outside >> This worked for me ! but why we have to put such a mask ? 255.255.255.255 i am bit wondering 🙂

Thank you.

Re: hi,you should be in global

johnlloyd_13 — Sat, 24 Sep 2022 02:01:55 GMT

hi,

all 255 (255.255.255.255) is a host subnet mask.

it's a /32 in CIDR notation.