1

According to this documentation it should be possible to enable an SSH connection to a Cisco ASA 5505. However, it is not possible to ping an IP from the ASA while this has been configured. As it is impossible to ping internally then SSH from another system will work neither.

ciscoasa# sh run
...
interface Vlan 100
  nameif inside
  security-level 100
  ip address 192.168.0.10 255.255.255.0
!

Ping from ASA

ciscoasa# ping 192.168.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:
No route to host 192.168.0.10

Success rate is 0 percent (0/1)
2
  • 1
    Are you able to post a full sanitized config? There are many areas that are relevant to ICMP traffic on the ASA. – some_guy_long_gone Aug 15 '14 at 21:36
  • 2
    Has the vlan 100 interface got a status of up? If the interface is not up it wont ping... – GerryEgan Aug 15 '14 at 23:21
8

The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears down.

After ensuring vlan 100 is up/up, you'll need both a crypto key for SSH and a statement like ssh 192.168.0.0 255.255.255.0 inside to permit all inside hosts on that subnet to SSH into the firewall. Also check your SSH supported versions so client and server (firewall) are compatbile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.