topic SSH to ASA from outside stops working after some time in Network Security

SSH to ASA from outside stops working after some time

smunzani — Mon, 11 Mar 2019 20:52:41 GMT

Hi,

I have been facing this weird issue for a few months. I tried latest 8.4.1 code too and nothing seems to help.

Aftrer a few days, ssh to outside interface from internet stops working that worked before. At the same time it works from internal interface. To get more productive data, I ssh to the firewall from internal side and ran capture command on the outside interface. Below is the capture results.

1: 22:54:37.731483 67.184.33.71.31049 > 216.7.16.2.22: F 1991970469:1991970469(0) ack 1308993793 win 65535

2: 22:54:37.731544 216.7.16.2.22 > 67.184.33.71.31049: . ack 1991970470 win 8192

3: 22:54:37.752921 67.184.33.71.31049 > 216.7.16.2.22: . ack 1308993793 win 65535

4: 22:55:12.877792 67.184.33.71.59626 > 216.7.16.2.22: S 4282824925:4282824925(0) win 65535 <mss 1380,nop,wscale 3,nop,nop,timestamp 754137833 0,sackOK,eol>

5: 22:55:12.877853 216.7.16.2.22 > 67.184.33.71.59626: S 2732681542:2732681542(0) ack 4282824926 win 8192 <mss 1380>

6: 22:55:12.899260 67.184.33.71.59626 > 216.7.16.2.22: . ack 2732681543 win 65535

Did not find much on google search.

Current work around is SSH to the box from inside interface and reboot. After reboot things will work for a few days and then it will stop again. Its really annoying issue since some of my remote sites are only accessible from outside since there are not boxes I can hop on to in order to SSH.

Thanks in advance,

Sam

SSH to ASA from outside stops working after some time

Maykol Rojas — Wed, 29 Jun 2011 18:12:04 GMT

Do you use secure copy protocol?

Mike

SSH to ASA from outside stops working after some time

smunzani — Wed, 29 Jun 2011 18:13:29 GMT

No. Secure Shell it self. It stops working and only reboot fixes it.

Thanks,

Sam

SSH to ASA from outside stops working after some time

Maykol Rojas — Wed, 29 Jun 2011 18:29:05 GMT

Once you have the issue, please gather the following,

show process | inc ssh

show asp table socket

show ssh ssessions

Put the debug ssh

Try to connect via ssh

Thanks.

Mike

SSH to ASA from outside stops working after some time

smunzani — Wed, 29 Jun 2011 18:32:36 GMT

Will do. I did debug ssh but that didn't reveal anything and that led me to capture. I have symptoms going at one of the site now but don't have a way to get in remotely now to run these commands. Will have to wait till the symptoms show up at one of the site where I have internal LAN access.

SSH to ASA from outside stops working after some time

varrao — Wed, 29 Jun 2011 18:42:22 GMT

There are a few known issues with SSH on version 8.4.1, now there are two options for you, furst move on to the latest code in version 8.4.x train or open a TAC case for the correct identification of the bug.

Hope this helps.

Thanks,

Varun

SSH to ASA from outside stops working after some time

smunzani — Wed, 29 Jun 2011 18:44:34 GMT

I will go with easy option of upgrade 1st. See if that fixes the problem. If not, I will open a case.