0

I just realized one of my switches are not reachable by SSH and even Telnet. I just noticed that of recent, and I don't know what could be the problem.
This Switch is in a large network, and we normally connect via TACACS authentication.
In trying to connect, I get the following "Network error: Connection refused"

What can be done in this scenario?
Is this related to the access list? If yes what is the relationship between Access lists and SSH login to devices via TACACS.

Thanks

  • You need to get a console connection into your switch, get the configuration, then edit your question to include the configuration, otherwise we can only offer speculation and guesses. – Ron Maupin May 11 '16 at 15:02
  • If you need any help, you need to put your configuration here to see what can be causing problems. For your safe, delete users, names, IPs(publics) and that kind of stuff. – Orlando Gaetano May 11 '16 at 15:19
  • Working on that... – NTD May 11 '16 at 15:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 2:46
2

Connection refused means the switch us alive (pingable). So it could be an acl, or the vty lines being disabled. It's possible someone logged in, changed the config and got thrown out. If you are lucky the running config hasn't been saved, so you could reboot (usually a "reboot in X" is a good idea when messing with authentication) and hope it comes up with a saved config that still allows access.

Or simply as Ron Maupin said, get console access. If it's in a remote location I would try get someone to restart it. Do you save your logs somewhere? Perhaps that will give a hint as to who did what.

Also another thought, yoy said you use TACACS, is the TACACS server reachable from the location of the switch? Check routing and acls towards the TACACS servsr. In general it's good practice to configure a local fallback method, so that when tacacs is not reachable you can use a local user.

  • 3
    Tacacs is not the problem -- you would get a login prompt. ACL is not the problem, you would get a timeout error. Connection refused means the switch sent back a RST. So that means Telnet or SSH isn't configured. It might be missing the "transport input telnet/ssh" command on the vty lines. – Ron Trunk May 11 '16 at 17:46
  • You could try snmp to see if you can get access that way. – Ron Trunk May 11 '16 at 17:46
1

You have not enabled telnet or ssh access to the vty ports.

R1(config)#ip domain-name mydomain.com
R1(config)#username admin Password cisco
R1(config)#crypto key generate rsa
R1(config)#ip ssh version 2
R1(config)#ip ssh time-out 50
R1(config)#ip ssh authentication-retries 4

R1(config)#line vty 0 4
R1(config-line)#transport input ssh telnet
R1(config-line)#password cisco
R1(config-line)#login 
R1(config-line)#logging synchronous 
R1(config-line)#exec-timeout 40
R1(config-line)#exit 
R1(config)#wr mem
0

There is few options why this could not work:

  1. missing ssh key on switch
  2. missing input at transport
  3. time desynchronization
  4. invalid access-class at transport

In this option you can try console and hope for the best, otherwise factory reset.

Not the answer you're looking for? Browse other questions tagged or ask your own question.