There are three interfaces, TRUST (security level 100), UNTRUST (security level 0), and DMZ (security level 50).

I am on a network coming into the firewall via the UNTRUST interface. The switch I am able to use ICMP with but not SSH to (timeout) is connected via the DMZ interface. There are three rules which each included the same service group (including icmp, tcp/ssh, udp/tftp, tcp/telnet, udp/syslog). These rules are applied as follows:

DMZ Interface (incoming)
    DMZ_network any IP permit

TRUST Interface (incoming)
    DMZ_switch my_laptop service_group permit

UNTRUST Interface (incoming)
    my_laptop DMZ_switch service_group permit

So I am able to ICMP, and I see increment on the rules that have been applied, but I receive connection-timeout for SSH connection attempts. I've spent too much time hitting my head on the proverbial wall to not reach out for an assist here. I appreciate anyone and everyone who takes time to read or answer this question.

Regards, lzer


2 Answers 2


Considering that your ruleset is correct... Have you checked on the switch side? There might be an access-class configured on your vty.

p.s. you may want to use packet-tracer on ASA to check if traffic would be permited or just check the logbuffer via CLI/ASDM to see what is really going on.

Let me know if you need any help.


I believe you should have an ACL in the OUT direction for the DMZ interface.

Traffic will enter the untrusted interface for which you have an ACL - fine Then traffic will exit (out) the DMZ interface where the switch management is.

Hence why you need to permit "laptop_ip dmz_switch any_service_you_want"

You do not need to worry about the "return" traffic as the ASA will keep the state

Let me know if it is clear what I wrote above

Regards Ravi

  • None of the interfaces have OUTGOING access rules set and I am able to successfully authenticate to and access other switches.
    – skrap3e
    Dec 30, 2015 at 7:27
  • In that case, you may want to check if ssh is properly configured on that switch (that is, hostname, key etc). Alternatively type "debug ssh" to see what is going on
    – Ravi
    Dec 30, 2015 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.