topic Re: unable to ssh to ASA on outside interface? in Network Security

unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 17:00:26 GMT

i aded ssh 0.0.0.0 0.0.0.0 Outside but still cannot connect ssh to my outside interfae

do I also require any access-list?

do we have any example i can look at?

Re: unable to ssh to ASA on outside interface?

Rob Ingram — Thu, 20 Apr 2023 17:16:04 GMT

@nflnetwork that command should permit access SSH access from any IP address connecting on the outside interface, no ACL required.

Can you actually SSH to the ASA from any other interface?
Is authentication and RSA keypair already setup?

Example - https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118075-configure-asa-00.pdf

username admin password <password> privilege 15
crypto key generate rsa modulus 2048
aaa authentication ssh console LOCAL
ssh version 2

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 17:16:23 GMT

Try this way

Add new interfaces (any one)

Make it security level =0 and make security level of outside interface =1

Abd the try ssh to ASA

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 17:50:14 GMT

still not able to pass traffic.

ssh traffic on my outside interface OR inside traffic out to Outside other than ICMP

also noticing cannot get inside, outside traffic working now

i can ping 8.8.8.8 from inside host but cannot get anything else

no ACL should be required for this correct???

ge0/0 -wan

security level 1

ge 0/1 - lan

security level 100

nat (Inside,Outside) dynamic interface

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 17:54:43 GMT

No ACL require but there must be any interface in ASA that have security level lower than outside, add any dummy interface and check.

Re: unable to ssh to ASA on outside interface?

Rob Ingram — Thu, 20 Apr 2023 17:58:13 GMT

@nflnetwork if you cannot from SSH from any interface do you even have the 3DES/AES license?

You didn't respond to the initial question regarding with you have a RSA keypair and authentication setup.

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 17:58:48 GMT

configured ge0/2 with security level 0

changed ge0/0 - wan to security level 1

same issue

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 18:03:17 GMT

if not solve you issue then check @Rob Ingram suggestion

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 18:04:50 GMT

yes, it works on inside interface.

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 18:12:21 GMT

yes i can SSH from the inside interface - no issue

Re: unable to ssh to ASA on outside interface?

Rob Ingram — Thu, 20 Apr 2023 18:21:11 GMT

@nflnetwork so when you fail to SSH to the outside interface, where are you physically connected? You cannot be connected on the inside and SSH to the outside interface, that won't work. You'd need to SSH to the outside interface when connected on the outside.

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 18:23:42 GMT

host on my LAN (192.168.254.2) > to inside interface on ASA (192.168.254.1) - ssh works

when trying to ssh to outside interface i am on the internet

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 18:23:54 GMT

Under g0/2

No shut

And check again.

Thanks

MHM

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 18:26:24 GMT

done. no change

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 18:43:19 GMT

Ok, last point to check is are you config any PAT of SSH in asa?

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 18:53:48 GMT

the only nat i have is

object network inside-subnet
 subnet 192.168.254 255.255.255.0
 nat (inside,outside) dynamic interface

Re: unable to ssh to ASA on outside interface?

nflnetwork — Thu, 20 Apr 2023 19:38:00 GMT

hello all - it is workin now.

we had an upstream WAN switch with an ACL blocking the traffic.

Re: unable to ssh to ASA on outside interface?

MHM Cisco World — Thu, 20 Apr 2023 19:40:18 GMT

glad your issue solved
thanks for update
just for note it work with or without security level change of OUTside interface ?