ASA 5505 ssh access question

[yliu000011]

Hi,

Currently any ip address can ssh to my asa 5505 firewall outside interface. What should I do to restrict only certain IP can? What's the command to see the current ssh management access rule?

Thanks.

Ye 

[johnlloyd_13 · Accepted solution]

hi,

try to issue a show run ssh.

you can restrict by using the ssh command such as below:

ssh <IP SUBNET> <SUBNET MASK> <INTERFACE>

ssh 1.1.1.0 255.255.255.0 outside

OR

ssh 1.1.1.50 255.255.255.255 outside

[yliu000011]

I tried this and got an error. Please help.

CL-T179-12IH# ssh 162.221.204.59 255.255.255.255 outside
                                 ^
ERROR: % Invalid input detected at '^' marker.

Also when I do   "show run ssh" I see below line. How to remove it?

ssh 0.0.0.0 0.0.0.0 outside

Thanks.

Ye

[johnlloyd_13 · Accepted solution]

hi,

you should be in global config mode in order to add the SSH line:

CL-T179-12IH# conf t

CL-T179-12IH(config)# ssh 162.221.204.59 255.255.255.255 outside

put a 'no' in order to negate a line and a issue a write memory to save your config.

CL-T179-12IH(config)# no ssh 0.0.0.0 0.0.0.0 outside

[yliu000011]

Thanks a lot.

Ye

[Brahim O]

After hours googling on how to allow only 1 IP for SSH access on ASA firewall on Packet Tracer, you saved my life !! 

CL-T179-12IH(config)# ssh 162.221.204.59 255.255.255.255 outside >> This worked for me !  but why we have to put such a mask ? 255.255.255.255 i am bit wondering

Thank you.

[johnlloyd_13]

hi,

all 255 (255.255.255.255) is a host subnet mask.

it's a /32 in CIDR notation.