2

I configured an ssh connection on an ISR 4451 router, which always worked perfectly.
For several weeks, every time I want to connect with Putty via SSH, I get an "access denied". I also cant connect from any other device via SSH to the router.

I have created a new user in ISR and created a new SSH key, but even with this, no connection is possible.
SSH connection to other router and switches works fine.

Why I get an access denied?

username admin1 privilege 15 password 7 XXXXXXXX  
line vty 0 4   
exec-timeout 60 0  
password 7 XXXXXXX  
login local  
transport input ssh 

But I have:
no aaa new-model

best regards
Sven

  • 2
    Can you provide the configuration of ISR 4451? Then we might have a better insight what is going on – Lukas Jul 31 '18 at 10:03
  • @Sven you should never post passwords in comments or anywhere on SE sites. You should remove it. Update your post with the comment data and replace the password with X's instead. – user36472 Jul 31 '18 at 13:32
  • Have you tried connecting via console ssh from any linux (i.e. WSL) with enabled debug output? Try ssh -v and redirect the output into a file (so it does not interfere with your ssh session). – mbx Aug 29 '18 at 13:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:10
1

If you're using putty, then it's likely that you have "Attempt GSSAPI authentication" enabled. You can find this under Connection>SSH>Auth>GSSAPI. GSSAPI is usually used in Kerberos and not used in Cisco devices

  • Hello, i uncheck the GSSAPI checkbox but it still cant connect. I thing it work before also with GSSAPI enabled to connect and to other Cisco devices I can connect with GSSAPI. bg Sven – Sven Aug 1 '18 at 6:31
  • Does it only have 5 maximum vty session available? Because there's a chance that you're on session 6 or higher. line vty 0 4 enables SSH on the first 5 sessions – ashraf Aug 2 '18 at 9:45
1

If you dont use TACACS or RADIUS authentication, for the local SSH access you should have this commands in your running-configuration (checked with ISR4321):

aaa new-model
aaa authentication login default local
username ***Username*** privilege 15 secret ***Secret***
ip ssh version 2
line vty 0 4
 transport input ssh

*EDIT: The point is that you should use aaa authentication login default local instead of login local in your line vty 0 4

0

I believe you need AAA (just remove the "no") as well as set the domain. If you have keys generated, should work. Run a debug on ssh and see if you're seeing requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.