5

I set up a Cisco ASA 5505 8.4(3), and

  • specified ssh version 2
  • enabled ssh access to the WAN interface via ssh <my network> <mask> <WAN interface>
  • allowed ssh from my network via an ACL
  • my user account has privilege 15 with full access, including ssh

I did similarly for ASDM and it worked. However, when connection via ssh, I get:

ssh: connect to host <name> port 22: Connection timed out

I checked the log via the ASDM, which confirmed that there's a connection, but ending with an error message:

SSH session from on interface for user "" disconnected by SSH server, reason: "Internal error" (0x00)

How can it be fixed?

Improve this question
14
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 9, 2017 at 15:42
  • @RonMaupin I got a lot of such "Did any answer help you?" posts in my now spammy inbox. It requires action. Deleting my posts can help too.
    – Stefan
    Aug 9, 2017 at 16:15
  • I don't want to simply delete questions for which an answer may be expected, and many have good answers, just none are accepted. The goal is to get accepted answers for the archive. I don't mean to spam you, but you may have a bunch of questions that were answered, and you never accepted any. If you got a helpful answer to a question, you should accept it so that the person who took the time to answer you is rewarded, and the question doesn't keep popping up to the top forever, looking for an answer you already have.
    – Ron Maupin ♦
    Aug 9, 2017 at 16:19
  • @RonMaupin OMG! So 5 of my questions are not marked as "answered". 4 of them I answered myself. At that time, I found it inappropriate to discourage other answers by accepting my own one. I could today, it's just the bunch of copies of the same request for every single question in my inbox.
    – Stefan
    Aug 9, 2017 at 16:28
  • The questions with answers that have not been accepted are getting this. In essence, you are asking the same, apparently answered, question over and over. If you accept an answer, then you are no longer "spamming" Network Engineering, and you will not get these messages.
    – Ron Maupin ♦
    Aug 9, 2017 at 16:30

2 Answers 2

Reset to default
12

Unfortunately the ASA doesn't show a good explanation in the error message. It's required to create an RSA key on the ASA, either via console or command line in the ASDM, executing the command crypto key generate rsa, for example with highest possible modulus size:

crypto key generate rsa modulus 2048

in global configuration mode. The default modulus would be 1024.

With the ASDM it can also be done in the configuration menu, device management, identity certificates, add, new:

ASDM key generation

Since the other requirements were already met, the connection should be successful.

Since I cannot add images to comments to the question above, here a screenshot about mass bumping comment spam starting with one to this question and answer. That's a screenshot of moderator activity, no action by me.

comment spam

Improve this answer
4
  • Whereas other OS's auto generate keys when the SSH daemon is started, or in the case of a client the first time you try and connect unfortunately the ASA software doesn't give you any pointers or generate one automatically.
    – David Rothera
    May 30, 2013 at 21:11
  • 2
    well the Cisco IOS doesn't automatically generate the SSH cert either. you also need to type #crypto key generate rsa modulus 2048 then you can type $ip ssh version 2
    – knotseh
    May 30, 2013 at 21:26
  • 1
    technically, it shouldn't enable ssh unless it has a valid cert. I've never seen one start sshd without a cert.
    – Ricky
    May 30, 2013 at 23:17
  • 1
    I beat my head against this every time I deploy a new ASA. I always forget that everything looks fine in the config, but until you generate the RSA key it looks like an ACL issue.
    – Scott Boultinghouse
    May 31, 2013 at 18:38
1

  1. asa(config)# crypto key generate rsa general-keys modulus 2048

    If you don't have user accounts already then configure below two line 2-3.

  2. asa(config)# username ash password ash privi 15

  3. asa(config)# enable password cisco123

    To Allow Access from inside network

  4. asa(config)# ssh 0.0.0.0 0.0.0.0 inside (To Allow anyone from inside)

    To Allow Access from outside network

  5. asa(config)# ssh 0.0.0.0 0.0.0.0 outside (To Allow anyone from Outside)

    the system should know where your useraccounts are: For lookup in Local Database

  6. asa(config)# aaa authentication ssh console LOCAL ------ Case sensitive (LOCAL must be in capital, not Local or local)

  7. asa(config)# ssh version 2

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.