Unpredictable ssh source port from ISR4331

[jspriesterbach]

Hey all,

I am having a problem over the past few days where I've tried port forwarding 2222 => 22, and 2222 => 2222 to an ISR4331. This is the topology I am using including the relevant commands on each network device:

What happens is that the first packet will get to the ISR4331, then the ISR4331 decides to respond on a random source port, then the ASA doesn't detect that its from the same session and drops the packet (see pic below):

The weird thing is that when I first switched from using port 22 as the default port to port 2222 on the ISR4331, it started working for a while, then I had a power outage and when it came back up it started using random source ports for ssh again. Anyone have any ideas on how to fix this? I refuse to believe that this is just how it works, there's got to be something I'm doing wrong. I've tried downgrading my ios from 17.9.4a to 17.03.05 but that didn't help anything.

Any insight is appreciated! 

Thanks

[MHM Cisco World]

https://community.cisco.com/t5/cisco-software-discussions/configured-ssh-on-my-isr4431-k9-but-still-port-22-not-open/m-p/4965044#M8104

I already solve same issue for other engineer'

Check how you can force router to use specific port and config this port in asa nat and acl.

MHM

[jspriesterbach]

Hi MHM,

That didn't seem to solve the problem, I am still getting random source packets for ssh from the ISR4331:

Here is my router config:

ip ssh port 3333 rotary 1

line vty 0 15
access-class DenySSH22 in
exec-timeout 0 0
rotary 1
no exec
transport input ssh
stopbits 1

Thanks

[MHM Cisco World]

Because you use 3333 not 3331 for rotary 1

The idea of rotary is use port number ebd witg same rotary number 

I. E. 

Rotary 1 3331

Rotary 2 3332

And so on

https://brbccie.blogspot.com/2014/01/mini-vty-rotary_5.html?m=1

Note:- if 3331not work use 3001 as examples in link

[jspriesterbach]

Hi MHM,

That is good to know! But unfortunately I am getting the same issue using port 2001 as you stated in the link. I also had to remove the "no exec" from line vty 0 15 because it kept kicking out my ssh sessions. Here is my config:

ip ssh port 2001 rotary 1

line vty 0 15
 access-class DenySSH22 in
 exec-timeout 0 0
 rotary 1
 transport input ssh

Here is the SYN ACK failing on 2001:

I tried reloading and upgrading the firmware but got the same result. Thanks for your continued help with this tricky issue!

[MHM Cisco World]

Clear line vty all

Then try again 

[jspriesterbach]

Same outcome, ISR returns on random source port and the asa drops the packet.

[jspriesterbach]

I'll try that and get back to you, thanks

[Kanan Huseynli]

Can you check with :

sh ip ports all | section sshd to understand what ssh daemon uses?