Hi Everyone,
It's the first time I have got into this issue and wonder if any of you have ever experienced the same and maybe have an explanation. We have an ASA firewall that has to be SSH accessible for Cisco Prime on outside interface. SSH access on inside interface works fine.
SSH towards outside interface does not work neither from mentioned Cisco Prime nor other server that is on the same network where Cisco Prime is.
When setting up the session this is observed:
- SSH terminal - after entering the IP only the black screen appears w/o prompt for username / password
- Traffic capture on ASA shows 2 way SSH communication - see attachment
- SSH debug on ASA ends with error: SSH1: Session disconnected by SSH server - error 0x6e "Time-out activated"
- Here is the whole debug output:
ASA_xyz/pri/act# debug ssh
debug ssh enabled at level 1
ASA_xyz/pri/act# Device ssh opened successfully.
SSH1: SSH client: IP = '10.65.x.y' interface # = 2
SSH1: starting SSH control process
SSH1: Exchanging versions - SSH-2.0-Cisco-1.25
SSH1: send SSH message: outdata is NULL
server version string:SSH-2.0-Cisco-1.25
Device ssh opened successfully.
SSH2: SSH client: IP = '10.65.x.y' interface # = 2
SSH2: starting SSH control process
SSH2: Exchanging versions - SSH-2.0-Cisco-1.25
SSH2: send SSH message: outdata is NULL
server version string:SSH-2.0-Cisco-1.25
SSH1: Session disconnected by SSH server - error 0x6e "Time-out activated"
SSH1: receive SSH message: [no message ID: variable *data is NULL]
SSH1: receive unsuccessful - status 0x00
SSH configurations seems to be OK and is allowed both on outside and inside/mgmt interface. Note that SSH from host on inside/mgmt works fine (inside/mgmt interface is NOT set to be Management):
ASA_xyz/pri/act# sh ssh
Idle Timeout: 20 minutes
Version allowed: 2
Cipher encryption algorithms enabled: aes128-gcm@openssh.com aes256-ctr aes256-cbc aes192-ctr aes192-cbc aes128-ctr aes128-cbc chacha20-poly1305@openssh.com
Cipher integrity algorithms enabled: hmac-sha2-256
Hosts allowed to ssh into the system:
172.22.x.y 255.255.255.240 outside
10.65.x.y 255.255.255.255 outside
10.65.x.y 255.255.255.255 outside
10.10.x.y 255.255.255.0 mgmt
Hardware and software version:
- ASA 5516-X
- Software 9.16.2
As always - thanks for your time!
Cheers
/mc
