SSH and zone-based firewall

[Kris McCormick]

Hello,

From the outside, I am unable to SSH into a Cisco 2901 router with a zone-based firewall. I suspect I need to add SSH to one of the zones but I'm not sure which one. I've attached the configuration in a text file.

Thanks in advance to anyone that can point me in the right direction.

[cadet alain · Accepted solution]

Hi,

you want to ssh into the router from any outside IP or from a specific one ?

The problem is here:

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

policy-map type inspect ccp-permit

class type inspect ccp-cls-ccp-permit-1

  pass

class type inspect SDM_EASY_VPN_SERVER_PT

  pass

class type inspect SDM_EASY_VPN_CTCP_SERVER_PT

  inspect

class class-default

  drop

the ssh traffic is classified as class-default traffic and is dropped.

You may do this if you want any IP to ssh:

ip access-list extended SSH

  permit tcp any any eq ssh

class-map type inspect SSH_ACCESS

match access-group name SSH

policy-map type inspect ccp-permit

class type inspect SSH_ACCESS

   inspect

If you want to permit only certain IPs then modify the ACL consequently

Regards.

Alain

Don't forget to rate helpful posts.

[Kris McCormick]

Thanks Alain, I did want to enable ssh from any outside IP so this worked perfectly!

Somewhat off topic, do you know a good resource for learning more about zone-based firewalls?

Kris

[cadet alain]

Hi Kris,

Deploying Zone-Based Firewalls (Digital Short Cut) from Cisco Press

Regards.

Alain

Don't forget to rate helpful posts.