Cut-Through proxy and SSH

saronm — Mon, 11 Mar 2019 18:47:47 GMT

Hi,

I am trying to get cut through proxy to authenticate SSH connectivity. If I use telnet, the firewall will proxy correctly and force local AAA authentication however, when using SSH, the connection is dropped with error :

processing uauth_error, session id: 2147483663, message: Must authenticate before using this service.

Why does the firewall not enforce AAA authentication when connecting using SSH rather than telnet??

Configured on ASA5510 SP - version 8.

Please assist?

Thanks!

Re: Cut-Through proxy and SSH

Marcin Latosiewicz — Thu, 30 Sep 2010 16:32:45 GMT

Saron,

On ASA you cannot use SSH to authenticate for CTP.

Supported authentication protocols:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/access_fwaaa.html#wp1061184

We'd need to somehow do a man in the middle attach on SSH flows to make CTP work with SSH.

Hope this helps,

Marcin

topic Cut-Through proxy and SSH in Network Security

Cut-Through proxy and SSH

Re: Cut-Through proxy and SSH