topic The issue can be easily in Network Security

SOLVED: ssh timeout issues - traffic through the device

Dario Francesco Vanin — Tue, 12 Mar 2019 05:34:34 GMT

Hi guys,

I upgraded our Cisco ASA 5520 with a Cisco ASA 5585. Though both ASA were configured with default TCP Idle Connection Timeout values people are now starting to complaint that idle SSH connections are being terminated. They are claiming it didn't occur with the old firewall. I would like to know if there is something related to IOS or a bug etc

New ASA
ASA5585
Cisco Adaptive Security Appliance Software Version 9.2(2)

Old ASA
ASA5520
ASA Version 9.1(3)

Command set for idle connection in a policy map is below

set connection timeout idle 0:05:00 reset dcd 0:00:15 3

Thanks,

Dario Vanin

Hi ,I think you should check

Vibhor Amrodia — Tue, 03 Mar 2015 11:22:06 GMT

Hi ,

I think you should check the SSH timeout value for the IDLE SSH timeout.

Also , TCP conn timeout value.

Thanks and Regards,

Vibhor Amrodia

Solved. The policy map was

Dario Francesco Vanin — Wed, 18 Mar 2015 02:49:25 GMT

Solved. The policy map was for other types of traffic. I solved the problem creating a new policy map for ssh traffic only.

Note: the problem was not about traffic to the device, but traffic through the device.

The issue can be easily

cciesec2011 — Wed, 18 Mar 2015 09:30:41 GMT

The issue can be easily resolved by not touching the firewall at all:

enable ssh keppalive on either the ssh server or ssh client. set the keepalive to every 30 seconds.

That will easily resolve the issue.