1

According to this documentation it should be possible to enable an SSH connection to a Cisco ASA 5505. However, it is not possible to ping an IP from the ASA while this has been configured. As it is impossible to ping internally then SSH from another system will work neither.

ciscoasa# sh run
...
interface Vlan 100
  nameif inside
  security-level 100
  ip address 192.168.0.10 255.255.255.0
!

Ping from ASA

ciscoasa# ping 192.168.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:
No route to host 192.168.0.10

Success rate is 0 percent (0/1)
Improve this question
2
  • 1
    Are you able to post a full sanitized config? There are many areas that are relevant to ICMP traffic on the ASA.
    – some_guy_long_gone
    Aug 15, 2014 at 21:36
  • 2
    Has the vlan 100 interface got a status of up? If the interface is not up it wont ping...
    – GerryEgan
    Aug 15, 2014 at 23:21

1 Answer 1

Reset to default
8

The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration. Since you're unable to ping the firewall's own 192.168.0.10 from itself, the interface appears down.

After ensuring vlan 100 is up/up, you'll need both a crypto key for SSH and a statement like ssh 192.168.0.0 255.255.255.0 inside to permit all inside hosts on that subnet to SSH into the firewall. Also check your SSH supported versions so client and server (firewall) are compatbile.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.