Solved: Re: Cannot SSH To Inside Interface From Subnet

jimmlegs · ‎06-13-2019

Any ideas why I cannot SSH from any clients on the 192.168.68.0/24 network to the inside interface IP of the ASA?

names
name 192.168.68.0 Net-NY2-SERVERS
name 192.168.168.64 Net-NY2-NETWORK
ip local pool temppool 192.168.0.10-192.168.0.15

!
interface GigabitEthernet1/1
description Trunk for providers, dmz1 and outside
speed 1000
duplex full
nameif outside
security-level 0
ip address 10.97.188.6 255.255.255.252
!
interface GigabitEthernet1/1.1
description to DMZ
vlan 100
nameif dmz1
security-level 50
ip address 10.97.189.193 255.255.255.224 standby 10.97.189.222
!
interface GigabitEthernet1/2
description Inside-Interface
speed 1000
duplex full
nameif inside
security-level 100
ip address 192.168.168.65 255.255.255.240
!
interface GigabitEthernet1/2.68
vlan 68
nameif inside-68
security-level 100
ip address 192.168.68.253 255.255.255.0
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8 outside
name-server 8.8.4.4 outside
name-server 1.1.1.1
domain-name tradeinformatics.com
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list inside_access_out extended permit ip aNY2 aNY2
pager lines 24
logging enable
logging timestamp
no logging hide username
logging standby
logging emblem
logging buffer-size 1048576
logging asdm-buffer-size 200
logging monitor informational
logging buffered warnings
logging trap debugging
logging history warnings
logging asdm informational
mtu outside 1500
mtu dmz1 1500
mtu inside 1500
mtu inside-68 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source dynamic any interface
nat (inside-68,outside) source dynamic any interface
nat (inside-68,inside) source dynamic any interface
nat (inside,inside-68) source dynamic any interface
access-group inside_access_out in interface inside
access-group inside_access_out in interface inside-68
route outside 0.0.0.0 0.0.0.0 149.97.188.5 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside
http Net-NY2-NETWORK 255.255.255.240 inside
http Net-NY2-SERVERS 255.255.255.0 inside-68
http Net-NY2-SERVERS 255.255.255.0 inside
no snmp-server location
no snmp-server contact
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.0.0 255.255.0.0 inside
ssh Net-NY2-NETWORK 255.255.255.240 inside
ssh Net-NY2-SERVERS 255.255.255.0 inside-68
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 86400
dhcpd auto_config outside
!
dhcpd address 192.168.168.70-192.168.168.74 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
cache
disable
error-recovery disable
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol l2tp-ipsec
default-domain value tradeinformatics.com
group-policy DfltGrpPolicy attributes
dns-server value 8.8.8.8
default-domain value tradeinformatics.com
group-policy Remote internal
group-policy Remote attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol ikev1
default-domain value tradeinformatics.com
dynamic-access-policy-record DfltAccessPolicy
username admin

class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global

Rob Ingram · ‎06-13-2019

Ok, I've re-read your original question. You are trying to access the INSIDE interface from the INSIDE-68 network....that won't work by design. You'll have to SSH to the local interface you are connect to, so from the INSIDE-68 network SSH to 192.168.168.65 should work.

View solution in original post

Rob Ingram · ‎06-13-2019

Hi,
Can the ASA actually communicate with the networks you are trying to SSH from?.....as you don't appear to have any routes for "inside" networks.

HTH

jimmlegs · ‎06-13-2019

I can ping the switch IP from the interface

ny4-asa(config)# ping inside 192.168.168.66

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.168.66, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

I can also ping the switch IP from the client network

C:\Users\RIM>ping 192.168.168.66 -S 192.168.68.75

Pinging 192.168.168.66 from 192.168.68.75 with 32 bytes of data:
Reply from 192.168.168.66: bytes=32 time=1ms TTL=255
Reply from 192.168.168.66: bytes=32 time<1ms TTL=255
Reply from 192.168.168.66: bytes=32 time=1ms TTL=255
Reply from 192.168.168.66: bytes=32 time<1ms TTL=255

I’ve added the following route but still have no SSH access

route inside-68 Net-NY4-SERVERS 255.255.255.240 192.168.168.66 1

Thanks,

Rob Ingram · ‎06-13-2019

Ok, I've re-read your original question. You are trying to access the INSIDE interface from the INSIDE-68 network....that won't work by design. You'll have to SSH to the local interface you are connect to, so from the INSIDE-68 network SSH to 192.168.168.65 should work.

jimmlegs · ‎06-14-2019

Thank you, I can SSH to the inside IP of the ASA.