topic Cisco ASA 5550 - unable to connect it via ssh in Network Security

Cisco ASA 5550 - unable to connect it via ssh

mitkin2891 — Mon, 11 Mar 2019 19:07:06 GMT

Hi All,

I have very strange issue and I can't find the source of the problem. Basically the diagram looks like the following (see the attachment).

The problem is that I'm not able to do ssh to 95.xx.xx.1 when I try from networks outside mine (for example 195.xx.xx.xx)

- I can make ssh to 192.168.0.1 from 192.168.0.10

- I can make ssh to 95.xx.xx.1 from 95.xx.xx.5

- I can make ssh to 95.xx.xx.5 from any Internet host

The configurion is simple:

I have access list configured in the interface pointing to Internet (that is 192.168.113.1) which allows ssh traffic from some networks (for example 95.xx.xx.xx).

This is part of the config:

ssh 0 0 ins

ssh 0 0 dmz

ssh 195.xx.xx.xx .... out

nat (ins) 1 0.0.0.0 0.0.0.0

global (dmz) 1 95.x.x.2 netmask 255.255.255.255

global (dmz) 1 94.xx.xx.2 netmask 255.255.255.255

route out 0.0.0.0 0.0.0.0 192.168.113.2

It is obvious that I'm missing something

Re: Cisco ASA 5550 - unable to connect it via ssh

Federico Coto Fajardo — Wed, 10 Nov 2010 13:35:49 GMT

Hi,

You're trying to SSH to the DMZ IP address of the ASA correct?

You will be able to do that from the DMZ network but not from any machine on any other interface.

The reason for this is that the ASA only allows connections from the same interface. This means....

Only inside machines can SSH to the inside IP

Only DMZ machines can SSH to the DMZ IP

Only outside machines can SSH to the outside IP

Federico.

Re: Cisco ASA 5550 - unable to connect it via ssh

mitkin2891 — Wed, 10 Nov 2010 13:45:46 GMT

Ok, I see now. So the configuration is correct, just this "feature" is not allowed on ASA. I didn't know that.

Thank you very much for your help.