I have an ASA5506-X that has been reimaged with FTD code - running the latest 6.2.3.15 version.
It is managed by a FMC that has been upgraded to 6.6. It is working and I can manage it via the FMC, however SSH has stopped working to any of the interfaces. It was working previously and I am not sure what has happened to stop it working.
I only wish to SSH to the management interface (br1) but I just get connection refused. The SSH access-list is configured for to allow connections from anywhere (configure ssh-access-list 0.0.0.0/0,::/0). I have tried to SSH using its IPv4 & IPv6 addresses but just get connection refused. Luckily I have an async terminal server so have a console connection via reverse telnet (perfect use for an ancient 2511 I still have..). I have reset the management interface IPv4 address and also changed the SSH access-list in the hope that it would kick it into life - however no luck so far.
I have added a SSH rule to permit SSH connections to any of the data interfaces, however this doesn't work either and I get the same 'connection refused'. It looks like the SSH daemon
has stopped? If I access expert mode and issue the command 'netstat -a' I can't see it listening on TCP/22 on either TCP or TCP6. If I issue this command on a FTDv I also have I can see it listening on TCP/22 (tcp *:ssh & tcp6 [::]:ssh)
If I attempt restart the ssh daemon I get this:
asa5506-ftd:~$ service sshd restart
/etc/ssh/sshd_config: line 23: Bad configuration option: CiscoSSHCommonCriteriaMode
/etc/ssh/sshd_config: line 37: Bad configuration option: CiscoSSHFipsMode
/etc/ssh/sshd_config: terminating, 2 bad configuration options
So I think there is some corruption somewhere...
Any ideas how I fix this without re-imaging it?
