SSH timeout in FTD

[hkchoudhary]

Hi Team,

I am trying to configure the SSH timeout for FTD. I see an option of Console Timeout under Device-->Platform Setting-->Timeout(Global). Is SSH and Console timeout in FTD are same? Also, I did the set 6 min as console output and did a save and deploy but if I run a command show running-config console timeout I still see 0 here, am I missing anything in there. 

[nspasov]

Hi there-

SSH Timeouts are configured in:

Devices > Platform Settings > Secure Shell

Console Timeouts are configured in:

Devices > Platform Settings > Timeouts > Console Timeout

To verify the console timeouts, you will need to connect to the FXOS CLI since FXOS where the console "lives." This can vary based on the hardware that you are using. For instance, for Firepower 1K/2K you can verify this by:

Connecting to the console port (Or SSH to the box and then issue "connect FXOS") > scope security > scope default-auth > show detail

I hope this helps!

Thank you for rating helpful posts!

[hkchoudhary]

Hi @nspasov,

Thank you for the quick response. I have an ASA Series device so I am unable to run connect command from FTD CLI. Below are the details for my VM :
Model: Cisco Firepower Threat Defense for VMWare (75) Version 6.2.3 (Build 20)

Cisco Adaptive Security Appliance Software Version 9.9(1)52
Firepower Extensible Operating System Version 2.3(1.54)

Hardware: ASAv, 8192 MB RAM, CPU Xeon E5 series 2197 MHz, 1 CPU (4 cores)
Model Id: ASAv30
Also while configuring SSH timeout if I navigate to Devices > Platform Settings > Secure Shell, I only see the option to add an SSH host, I don't see the option to select the SSH version or timeout as shown below :

For Console timeout, I configured it via Devices > Platform Settings > Timeouts > Console Timeout, but if I am trying to see the console output in the FTD CLI, I still se 0 in the running-config as shown below :

[hkchoudhary]

Hi Team,

Any update will be really appreciated.

[SaisPas]

Excerpt from a ticket on a similar issue, may be relevant:

Problem Description: As per the case notes, Altering console timeout value via FMC does not change Lina configuration.

Action Plan:

• As per the case notes, you altered the timeout value via FMC to 10 minutes and it’s not showing up in the LINA configuration.
• I have found a BUG which is a cosmetic bug related to this exact scenario.
• Bug ID: CSCvo35782
• Here is the link to refer above BUG ID:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo35782/?rfs=iqvred

• Symptom:
  Console timeout value altered from default infinite (e.g. 0) to a different value. The running configuration of Lina will show that the value is still set at 0. This is a cosmetic issue and the true value from which console timeout is getting invoked is under /etc/sf/clish_attributes.conf (example below):
  
  Changed timeout value to 10 minutes
  =======================
  
  FTD# sh run | i console
  console timeout 0
  
  root@FTD:/home/admin# cat /etc/sf/clish_attributes.conf
  INACTIVITY_TIMEOUT=600