topic Re: SSH timeout in FTD in Network Security

SSH timeout in FTD

hkchoudhary — Fri, 21 Feb 2020 17:44:34 GMT

Hi Team,

I am trying to configure the SSH timeout for FTD. I see an option of Console Timeout under Device-->Platform Setting-->Timeout(Global). Is SSH and Console timeout in FTD are same? Also, I did the set 6 min as console output and did a save and deploy but if I run a command show running-config console timeout I still see 0 here, am I missing anything in there.

Re: SSH timeout in FTD

nspasov — Thu, 05 Dec 2019 06:39:51 GMT

Hi there-

SSH Timeouts are configured in:

Devices > Platform Settings > Secure Shell

Console Timeouts are configured in:

Devices > Platform Settings > Timeouts > Console Timeout

To verify the console timeouts, you will need to connect to the FXOS CLI since FXOS where the console "lives." This can vary based on the hardware that you are using. For instance, for Firepower 1K/2K you can verify this by:

Connecting to the console port (Or SSH to the box and then issue "connect FXOS") > scope security > scope default-auth > show detail

I hope this helps!

Thank you for rating helpful posts!

Re: SSH timeout in FTD

hkchoudhary — Thu, 05 Dec 2019 08:50:28 GMT

Hi @nspasov,

Thank you for the quick response. I have an ASA Series device so I am unable to run connect command from FTD CLI. Below are the details for my VM :
Model: Cisco Firepower Threat Defense for VMWare (75) Version 6.2.3 (Build 20)

Cisco Adaptive Security Appliance Software Version 9.9(1)52
Firepower Extensible Operating System Version 2.3(1.54)

Hardware: ASAv, 8192 MB RAM, CPU Xeon E5 series 2197 MHz, 1 CPU (4 cores)
Model Id: ASAv30
Also while configuring SSH timeout if I navigate to Devices > Platform Settings > Secure Shell, I only see the option to add an SSH host, I don't see the option to select the SSH version or timeout as shown below :

For Console timeout, I configured it via Devices > Platform Settings > Timeouts > Console Timeout, but if I am trying to see the console output in the FTD CLI, I still se 0 in the running-config as shown below :

Re: SSH timeout in FTD

hkchoudhary — Mon, 09 Dec 2019 12:52:07 GMT

Hi Team,

Any update will be really appreciated.

Re: SSH timeout in FTD

SaisPas — Tue, 21 Jan 2020 02:19:18 GMT

Excerpt from a ticket on a similar issue, may be relevant:

Problem Description: As per the case notes, Altering console timeout value via FMC does not change Lina configuration.

Action Plan:

As per the case notes, you altered the timeout value via FMC to 10 minutes and it’s not showing up in the LINA configuration.
I have found a BUG which is a cosmetic bug related to this exact scenario.
Bug ID: CSCvo35782
Here is the link to refer above BUG ID:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo35782/?rfs=iqvred

Symptom:
Console timeout value altered from default infinite (e.g. 0) to a different value. The running configuration of Lina will show that the value is still set at 0. This is a cosmetic issue and the true value from which console timeout is getting invoked is under /etc/sf/clish_attributes.conf (example below):

Changed timeout value to 10 minutes
=======================

FTD# sh run | i console
console timeout 0

root@FTD:/home/admin# cat /etc/sf/clish_attributes.conf
INACTIVITY_TIMEOUT=600

Re: SSH timeout in FTD

Swapnil Merat — Tue, 05 Aug 2025 14:03:39 GMT

Thanks!