Keep getting kicked out (%SYS-6-TTY_EXPIRE_TIMER: (exec timer expired)

[milks126]

Hello guys,

I'm having a weird issue on 3850. I keep getting kicked out after about 15 sec once I ssh into the device. The log shows 14 14:26:58.970: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 4 (my ip)), user username

The switch is running on 16.12.9 and the aaa config and vty config are down below.

+ I had no issue with the same config on 3650...

aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local

line con 0
exec-timeout 15 0
stopbits 1
line aux 0
line vty 0 4
exec-timeout 15 0
transport preferred none
transport input ssh
line vty 5 15
exec-timeout 15 0
transport input ssh
transport output ssh

[balaji.bandi]

because of executive time out, after certain idle time that will be disconnected on VTY Lines

if you like to connect all time set as below in your VTY lines config

exec-timeout 0 0
or 
no exec-timeout 

[milks126]

@balaji.bandi even after i set that into vty, it is the same result. I still get kicked out after about 15 seconds.. 

line con 0
exec-timeout 0 0
stopbits 1
line aux 0
line vty 0 4
exec-timeout 0 0
transport preferred none
transport input ssh
line vty 5 15
exec-timeout 0 0
transport input ssh
transport output ssh
!

[balaji.bandi]

try  no exec-timeout

or

exec-timeout X X (X increase the time)

<0-2147483> Timeout in seconds

[milks126]

@balaji.bandii had no luck on both of them...

what I tried was no exec-timeout on each of the vty and exec-timeout 1800 1800...

I noticed that 3650 that was working was running on 16.12.8, not 16.12.9 which is the 3850 is running on.

Should I downgrade it to .8?

[balaji.bandi]

sure if that works for you, downgrade

not i have seen latest code of 3850 since more than year, since we moved to Cat 9K all over.

[milks126]

@balaji.bandi You know what it’s weird is that it’s ok when i console in via serial port. No timed out… anyways, i will go ahead and do downgrade it soon and come back!

[balaji.bandi]

Sure please let us know how it goes. when console not timing out, then those config need to apply other VTY Lines too.

[milks126]

@balaji.bandi I'm back.. I was able to downgrade to 16.12.6! Surprisingly, now I no longer get any error for exec-timeout, but I still get kicked out after ssh into the device for no reason. I don't understand why console connection is stable all the time even tho it has the same exe-timeout value...

[balaji.bandi]

can you post below output :

#show line vty 1

#show line vty 5

[milks126]

@balaji.bandi Hey, I'm sorry for being late.. too busy today.

Here is what I got from them.

sw-core#sh run | i vty 1
sw-core#show lin
sw-core#show line vty 1
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
3 VTY - - - - - 2 0 0/0 -

Line 3, Location: "", Type: ""
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600
Status: Ready, No Exit Banner
Capabilities: none
Modem state: Ready
Special Chars: Escape Hold Stop Start Disconnect Activation
^^x none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch
00:15:00 never none not set
Idle Session Disconnect Warning
never
Login-sequence User Response
00:00:30
Autoselect Initial Wait
not set
Modem type is unknown.
Session limit is not set.
Time since activation: never
Editing is enabled.

sw-core#show line vty 5
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
7 VTY - - - - - 0 0 0/0 -

Line 7, Location: "", Type: ""
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600
Status: No Exit Banner
Capabilities: none
Modem state: Idle
Special Chars: Escape Hold Stop Start Disconnect Activation
^^x none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch
00:15:00 never none not set
Idle Session Disconnect Warning
never
Login-sequence User Response
00:00:30
Autoselect Initial Wait
not set
Modem type is unknown.
Session limit is not set.
Time since activation: never
Editing is enabled.
History is enabled, history size is 10.
DNS resolution in show commands is enabled
Full user help is disabled
Allowed input transports are ssh.
Allowed output transports are none.
Preferred transport is telnet.
Shell: enabled
Shell trace: off
No output characters are padded
No special data dispatching characters
sw-core#

[balaji.bandi]

00:15:00 never none not set  (still show 15min)

may be setup time for maximum with exectimeout

Note : bare in mind if all the VTY Lines full no users able to login, that is the reason after idle reasonalble time client suggest to disconnect so VTY lines will be free.

Once of my test device i setup for 5 hours as below :

Special Chars: Escape Hold Stop Start Disconnect Activation
^^x none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch
05:00:00 never none not set

[milks126]

@balaji.bandi I understood. I just did not understand why I get kicked out after 15-20 sec even tho i set vtp for 15 mins. What i found was that I ssh to the date vlan IP from mgmt vlan IP and only allow ssh traffic to date vlan from mgmt vlan on my fw. I assume this caused the problem because when the client (my device ) sends tcp syn packet to the server(sw), but there is no syn/ack packet returned, so drop the connection. I will probably dig into this experiment over the weekend. I think we can close this here! I appreciated your help and sharing your knowledge!

[MHM Cisco World]

I send you message check it 

[milks126]

@balaji.bandi @MHM Cisco World Hello guys, first of all, thank you for investigating this. I kinda resolved the issue. The ssh session is stable when I ssh to the device on the same subnet.

i.e. my ip is on 10.10.10.10 and the switch is on 10.10.10.1.

But let's say I change my subnet to 10.10.2.1(vlan2) and try to ssh to the switch (vlan10). The session is able to be established, but it kicks me out a certain sec later. vlan2 is wide open since mgmt subnet. No fw rules.

Do you guys know why it's happening?