CoPP SSH not working

[sebastien3]

Hello,

From my computer 192.168.1.253 I would like to only be able to connect in SSH on port 2022 of the router. It does not work I cannot establish an SSH connection...

class-map match-any CoPP-SSH
match access-group name SSH-ACL
!
policy-map CoPP
class CoPP-SSH
police 8000 conform-action transmit exceed-action drop
!
control-plane
service-policy input CoPP
!
ip access-list extended SSH-ACL
permit tcp host 192.168.1.253 eq 2022 any
deny ip any any

ip ssh time-out 60
ip ssh port 2022 rotary 1
ip ssh version 2

line vty 0 4
login local
rotary 1
length 0
transport input ssh
transport output none

I can't find my mistake, can you help me ?

THANKS !

[marce1000]

                     >...I cannot establish an SSH connection...
                        - What error do you get then ?

  1) Verify if the port is open/available with for instance an nmap scan as in : %  nmap -p2022 yourswitch
  2) Connect with an ssh client supporting verbose modes (such as typical linux ssh) , perhaps it can provide more insights, 

 M.

[MHM Cisco World]

Always your post super 

Now

permit tcp any host 192.168.1.253 eq 2022 

Since the R is ssh server here and listen to port 

[sebastien3]

@marce1000: Yes the port 2022 is UP on router 192.168.1.1.

# nmap -p 2022 192.168.1.1
Starting Nmap 7.80 ( https://nmap.org ) at 2023-04-27 15:39 CEST
Nmap scan report for 192.168.1.1
Host is up (0.0013s latency).

PORT STATE SERVICE
2022/tcp open EtherNetIP-1
MAC Address: 00:C8:8B:9D:94:97 (Cisco Systems)

Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds

# ssh -p 2022 -l Cisco 192.168.1.1
kex_exchange_identification: read: Connection reset by peer
Connection reset by 192.168.1.1 port 2022

@MHM Cisco World: Even changing the ACL I can't connect to SSH...

[marce1000]

   >...# ssh -p 2022 -l Cisco 192.168.1.1
            kex_exchange_identification: read: Connection reset by peer
           Connection reset by 192.168.1.1 port 2022

  - Check the logs on the router when getting that error , also try for starters with removing any acl's and policing (COPP) , start with 'sufficient'  access (setup) on the intended port only , check if that can work, 

 M,

[MHM Cisco World]

If you add new acl then it can add after deny tcp any any' you must sure the acl line add in correct order 

[sebastien3]

You're right but that doesn't change anything either...

[sebastien3]

ip debug ssh : Apr 27 14:29:58.931: SSH: throttling requests: Please try after some time

Do you know the reason for this error ? The policy-map on control-plane does not increment as if the ACL does not match the traffic... ???

sh policy-map control-plane
Control Plane

Service-policy input: CoPP

Class-map: CoPP-SSH (match-any)
0 packets, 0 bytes
5 minute offered rate 0000 bps, drop rate 0000 bps
Match: access-group name SSH-ACL
police:
cir 8000 bps, bc 1500 bytes
conformed 0 packets, 0 bytes; actions:
transmit
exceeded 0 packets, 0 bytes; actions:
drop
conformed 0000 bps, exceeded 0000 bps

[MHM Cisco World]

Show policy-map control-map input 

I want to see default class 

[sebastien3]

Show policy-map control-map input does not work !

I'm having trouble understanding how CoPP works... Should I use access-class SSH-ACL in line vty 0 4 ?

[MHM Cisco World]

Show policy-map control-plane <<- this I want to see default class (try keyword input with it)

[sebastien3]

ASR1K#sh policy-map control-?
WORD control-plane

[MHM Cisco World]

Please check previous comment 

[sebastien3]

@MHM Cisco World As indicated above the counters only work if I add access-class in the vty line...

Is this normal ?

And to answer you, sh policy-map control-plane does show the INPUT with SSH-ACL

[MHM Cisco World]

permit tcp any host 192.168.1.253 eq 2022 

you config CoPP to all SSH to host 192.168.1.253
and you then mention 192.168.1.1 !!

that can make CoPP not work. 

for the ACL under VTY vs ACL in CoPP I deep dive to check the different, 
but NOW I need to see CoPP and use correct IP in SSH