topic My ASA 5505 stops accepting SSH connections after a few days in Network Security

My ASA 5505 stops accepting SSH connections after a few days

thomasdzubin — Mon, 11 Mar 2019 12:10:50 GMT

I have an ASA 5505 running v8.03 firmware that after a few days of uptime stops accepting SSH connections.

My SSH setup is pretty simple, just:

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

I get the following messages in my syslog when SSH stops working:

(yyy.y.yyy.y is my SSH client's IP, xxx.xxx.xxx.xx is the ASA firewall IP)

02-29 09:05:22 Local4.Info xxx.xxx.xxx.xx Feb 29 2008 09:08:30: %ASA-6-302013: Built inbound TCP connection 495222 for outside:yyy.y.yyy.y/56782 (yyy.y.yyy.y/56782) to NP Identity Ifc:xxx.xxx.xxx.xx/22 (xxx.xxx.xxx.xx/22)

2008-02-29 09:05:22 Local4.Notice xxx.xxx.xxx.xx Feb 29 2008 09:08:30: %ASA-5-321001: Resource 'ssh' limit of 5 reached for context 'single_vf'

2008-02-29 09:05:22 Local4.Info xxx.xxx.xxx.xx Feb 29 2008 09:08:30: %ASA-6-302014: Teardown TCP connection 495222 for outside:yyy.y.yyy.y/56782 to NP Identity Ifc:xxx.xxx.xxx.xx/22 duration 0:00:00 bytes 0 TCP FINs

Anyone have any ideas on what causes this and how to fix? (I've been rebooting the ASA to fix it which seems drastic)

I don't have any problems on any of my other ASA boxes, but they are running 8.02...so maybe this is something specific to 8.03?

(or maybe the box is under a DOS SSH attack which is using up all the SSH process resources?)

Re: My ASA 5505 stops accepting SSH connections after a few days

jason.henderson — Fri, 29 Feb 2008 20:38:19 GMT

It's a bug in the v8.03 software - Cisco Bug Toolkit recommends a downgrade to 7.x

Re: My ASA 5505 stops accepting SSH connections after a few days

thomasdzubin — Fri, 29 Feb 2008 21:19:40 GMT

Thanks... here are the details in case anyone else runs into it:

CSCsm68097 Bug Details

ASA 8.0.x - SSH resource exhausted preventing further sessions

Symptom:

Under a rare occurance, SSH sessions for management access can become locked preventing further SSH connections to be established to the ASA.

Conditions:

ASA 8.0(2), 8.0(3)

SSH enabled

Workaround:

A reload will clear the hanged SSH sessions.

-other types of connections still function (telnet,console)

-downgrade to 7.x code