1

If I do ip ssh source-interface g0, that restricts:

  1. which interface the Cisco device listens for SSH connections,
  2. which interface it is allowed to use for the client to connect to other SSH servers,
  3. which interface all SSH packets go out and/or permitted in (implying both 1 and 2), or
  4. None of the above.

Experimentally, it looks like 2, which is not what I had intuited originally, thus prompting the question for confirmation.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-i3.html#wp5893687220 -- Ref that seems to agree with my experimental conclusion, but I've been wrong trying to follow Cisco logic before.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Feb 19, 2018 at 19:20

2 Answers 2

Reset to default
1

Actually, none of the above. It doesn't actually determine any interface. That command, and other Cisco source commands, determine the source address on the traffic sourced on the device exiting the device, regardless of the actual interface used to forward the traffic. Remember that traffic is routed by the destination address.

Without any command, the source address on the traffic sourced from the device leaving the device would be the actual interface used, but the Cisco source commands can be used to change the source address to the address of a different interface on the router. Loopback interfaces are a good choice because loopback addresses never go down, unless you specifically configure them down.

For example, you have a router with Loopback0, GigbitEthernet0, GigbitEthernet1, and GigbitEthernet2. You probably want all traffic sourced from Loopback0 so that it doesn't matter which interface is used. That way, if the traffic would normally use GigbitEthernet0, but that interface goes down and the other device could still reach the router through GigbitEthernet2, then the conversation can continue normally because the source address remains the same.

Improve this answer
7
  • That seems odd; why would the command be source-interface if it absolutely means source-address? This is what I mean about following "Cisco logic".
    – Tim G
    Commented Sep 28, 2017 at 20:22
  • It is the source interface, and it uses whatever address is on the interface. You cannot simply plug in an address; the address must exist on an interface in the router, so you use the interface in the command, not the address. The command will pick up the address configured on the interface.
    – Ron Maupin ♦
    Commented Sep 28, 2017 at 20:23
  • @TimG, for example, you Loopback0 has the address 10.0.0.1 but using your method you enter the address, and you have a type and enter 10.0.0.2. The traffic would never be able to return to the router because it doesn't have that address. Using th interface instead of the address, you could re-address the interface, and the router would start using the new address, and you would need to go back to find and change your source commands.
    – Ron Maupin ♦
    Commented Sep 28, 2017 at 20:27
  • Oh, Point of clarification: "determines the source address on" server, client or both "traffic exiting the Cisco device"?
    – Tim G
    Commented Sep 28, 2017 at 20:42
  • On traffic originating from the router. A router doesn't modify addressing on traffic passing through it, unless it has NAT configured.
    – Ron Maupin ♦
    Commented Sep 28, 2017 at 20:43
0

You might use this when a device you want to access only accepts connections from a specific subnet, say 10.1.1.0/24, but the connected interface the traffic will route from is on 172.16.1.0/24.

The command only affects SSH connections from the router.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.