SSh and telnet are not working. somtimes it works for few minutes

[bukhari_genius]

SSh and telnet are not working. somtimes it works for few minutes







!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 4096
enable secret 5 227263637537353657356376
!
no aaa new-model
!
dot11 syslog
ip source-route
!
!
!
!
!
ip cef
ip domain name faisal
no ipv6 cef
!
multilink bundle-name authenticated
!
!
license udi pid CISCO1841 sn FGL153229LV

username Faisal password 71212123A0C1512eeueyeyeuF7E
!
redundancy
!
!
ip ssh rsa keypair-name new_key
ip ssh logging events
ip ssh version 2
!
track 1 interface FastEthernet0/0 line-protocol

ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
!

line con 0
line aux 0
line vty 0 4
 password 7 18183738373839383
 login local
 transport input telnet ssh
 transport output none
!
scheduler allocate 20000 1000
end

[Mark Malone]

in what sense is it not working can you still ping the router when the ssh is not working is reachability there ?

are the ssh keys there in place or are you regenerating them ?

have you ran  a debug Ip ssh when trying to connect to the router to see what's occurring

[bukhari_genius]

yes, i m able to ping the router but when i port screen my router it does not any port open except 80 and 443. no access list is define  and i m receiving below logs when i type show logging.

May 19 07:17:00.996: %SSH-5-SSH2_CLOSE: SSH2 Session from 203.124.26.198 (tty = 2) for user '' using crypto cipher '', hmac '' closed
May 19 07:17:09.448: SSH2 CLIENT 2: Invalid modulus length
May 19 07:17:09.448: %SSH-5-SSH2_SESSION: SSH2 Session request from 203.124.26.198 (tty = 2) using crypto cipher '', hmac '' Failed
May 19 07:17:09.448: %SSH-5-SSH2_CLOSE: SSH2 Session from 203.124.26.198 (tty = 2) for user '' using crypto cipher '', hmac '' closed

R1#show logging history
Syslog History Table:1 maximum table entries,
saving level warnings or higher
1112 messages ignored, 0 dropped, 0 recursion drops
11 table entries flushed
SNMP notifications not enabled
entry number 12 : SSH-4-SSH2_UNEXPECTED_MSG
Unexpected message type has arrived. Terminating the connection
timestamp: 496002092

<cr>

R1#show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC6HN4fnO7c+YWE1eu/lHFbTfwN837vJwVnLduPlZtI
Am7SBs/+RlBFCfsiNg2dJzLifX+w7vQg5Ml/uaiyu/eoGmYs2INXUYCh881TyBzeGHoGt4g/huyOm60u
j3qHwczOQMbDJ1jV3aW81/Q8A1zMIqUeZksZP0owFLxuVPx+/w==

[Mark Malone]

put an access list on vty straight away , always have an acl on your vty or your susceptible to a brute force hack attack through ssh , that log can be from outside users trying to access the device through ssh too

I would recreate the ssh keys too make sure there versions 2 ,set them to 1024 only ..crypto key generate rsa 1024

Then also make sure the terminal system your coming from is able to do version 2 , in putty its under settings connection -ssh

to slow down any brute attack its good practice to use this as well

login block-for 300 attempts 10 within 60
login quiet-mode access-class x (this si the acl number under your vty port)

you have telnet configured as well I would disable that on input its unsecure , if its only in place until ssh is fully working maybe leave it till then

does your issue exist if you use a different terminal like crt or hyperT

[bukhari_genius]

i have configured access-class but issue is same i cannot access the router via telnet and ssh.  

[Mark Malone]

You cant access via telnet either , is  the cpu maxed on the device ..show proc cpu sorted and is there free memory , show memory or maybe show mem free

anything in logs related to mem or cpu issues ?

also in console when logged in check that there are free vty lines for you to actually come in over  and that there all not in use or locked up  , show users

if they are clear them , clear line vty x

if you see mem or cpu issues, reload the device when you can to free up all the counters and reset everything  

[bukhari_genius]

below are 

R1#sh processes cpu
CPU utilization for five seconds: 3%/2%; one minute: 3%; five minutes: 3%

show memory
Head Total(b) Used(b) Free(b) Lowest(b) Largest(b)
Processor 6586F620 152635872 39197604 113438268 106644908 102366412
I/O EEA00000 23068672 4421440 18647232 18563472 18604348

R1#show line vty 0 1
Tty Line Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
194 194 VTY - - - - - 7038 0 0/0 -
195 195 VTY - - - - - 4396 0 0/0 -

[Mark Malone]

ok last thing I would check is debug the ssh as your connecting to it see what the router shows

debug ip ssh

then generate a connection to it , you have tried other terminals different pc etc to rule out your end device as being the issue , turned off your local firewall on the pc etc as a test

its a bit strange that cpu and mem is fine you have reachability and both protocols are dropping off , telnet only requires a password and reachability to a device to work unlike ssh which requires extra parameter's

[bukhari_genius]

both action have been performed but nothing is display on the router.

debug was enable and firewall was disable 

[Mark Malone]

ok so that tells us that the ssh protocol is not hitting the router when you initiate it from your device and something is dropping it or stopping it

when ssh debug is enabled on the router if it fails to log you in the debug will run and show all that or show a successful login ot can only be one or the other  , the fact your not even seeing anything from the debug suggests the ssh protocol is not reaching it which may explain why telnets not working either that could be dropped intermittently , wthere that path you take somethings overloaded or its actually being dropped

if this was my device at this stage I would directly connect to the router as a lan user give my self an ip and ssh that way to prove the ssh config and feature is working when directly connected to the device , if its still not working maybe you have some bug in ios that's causing it and need to upgrade ios once your keys etc are all in place  , if it is working you need to go through the path you take to the router using ssh and see what's blocking it , just because icmp reachability is there , doesn't mean every other protocol may be allowed at higher layers or something may be so over utilised the ssh/telnet  traffic is only getting though sometimes

the fact 2 separate features for remote access aren't working to the router would point to something else being the cause in the access up to the router