2

I configured an ssh connection on an ISR 4451 router, which always worked perfectly.
For several weeks, every time I want to connect with Putty via SSH, I get an "access denied". I also cant connect from any other device via SSH to the router.

I have created a new user in ISR and created a new SSH key, but even with this, no connection is possible.
SSH connection to other router and switches works fine.

Why I get an access denied?

username admin1 privilege 15 password 7 XXXXXXXX  
line vty 0 4   
exec-timeout 60 0  
password 7 XXXXXXX  
login local  
transport input ssh

But I have:
no aaa new-model

best regards
Sven

Improve this question
4
  • 2
    Can you provide the configuration of ISR 4451? Then we might have a better insight what is going on
    – phandox
    Jul 31, 2018 at 10:03
  • @Sven you should never post passwords in comments or anywhere on SE sites. You should remove it. Update your post with the comment data and replace the password with X's instead.
    – user36472
    Jul 31, 2018 at 13:32
  • Have you tried connecting via console ssh from any linux (i.e. WSL) with enabled debug output? Try ssh -v and redirect the output into a file (so it does not interfere with your ssh session).
    – mbx
    Aug 29, 2018 at 13:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:10

3 Answers 3

Reset to default
1

If you're using putty, then it's likely that you have "Attempt GSSAPI authentication" enabled. You can find this under Connection>SSH>Auth>GSSAPI. GSSAPI is usually used in Kerberos and not used in Cisco devices

Improve this answer
2
  • Hello, i uncheck the GSSAPI checkbox but it still cant connect. I thing it work before also with GSSAPI enabled to connect and to other Cisco devices I can connect with GSSAPI. bg Sven
    – Sven
    Aug 1, 2018 at 6:31
  • Does it only have 5 maximum vty session available? Because there's a chance that you're on session 6 or higher. line vty 0 4 enables SSH on the first 5 sessions
    – ashraf
    Aug 2, 2018 at 9:45
1

If you dont use TACACS or RADIUS authentication, for the local SSH access you should have this commands in your running-configuration (checked with ISR4321):

aaa new-model
aaa authentication login default local
username ***Username*** privilege 15 secret ***Secret***
ip ssh version 2
line vty 0 4
 transport input ssh

*EDIT: The point is that you should use aaa authentication login default local instead of login local in your line vty 0 4

Improve this answer
0

I believe you need AAA (just remove the "no") as well as set the domain. If you have keys generated, should work. Run a debug on ssh and see if you're seeing requests.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.