Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Can't SSH into ASA

Status
Not open for further replies.

pbxnkey

Programmer
Aug 15, 2006
191
0
0
US
I used to be able to SSH into the ASA via the outside and failover interfaces but now I cannot.
I even tried allowing telnet from ANY to both interfaces and it won't work. I cleared the RSA keys and Re-generated but still no luck. Rebooted several times and still no luck.
I have suspect that the traffic is being routed over a vpn tunnel that is configured.
I don't even see the connection when viewing the logs.
Any help would be appreciated.
ASA# sho run
: Saved
:
ASA Version 8.2(1)
!
hostname ASA
enable password nVOwdBhYzmL3XgRr encrypted
passwd cZu6V5MqbEMPzK4N encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.32.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.252
!
interface Vlan3
nameif failover
security-level 0
ip address x.x.x.x 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 3
!
ftp mode passive
access-list 101 extended permit ip 192.168.32.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list 101 extended permit ip 192.168.32.0 255.255.255.0 192.168.13.0 255.255.255.0
access-list NONAT extended permit ip 192.168.32.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list NONAT extended permit ip 192.168.32.0 255.255.255.0 192.168.16.0 255.255.255.0
access-list NONAT extended permit ip 192.168.32.0 255.255.255.0 192.168.13.0 255.255.255.0
access-list 102 extended permit ip 192.168.32.0 255.255.255.0 192.168.16.0 255.255.255.0
access-list 102 extended permit ip 192.168.32.0 255.255.255.0 192.168.13.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging buffer-size 10000
logging asdm-buffer-size 512
logging buffered debugging
logging trap warnings
logging history informational
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu failover 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-647.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (failover) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0.0.0.0 0.0.0.0
nat (failover) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 track 1
route failover 0.0.0.0 0.0.0.0 x.x.x.x 100
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
url-server (inside) vendor websense host 192.168.10.151 timeout 30 protocol TCP version 4 connections 5
filter https 443 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
filter ftp 21 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 1
type echo protocol ipIcmpEcho x.x.x.x interface outside
num-packets 3
frequency 10
sla monitor schedule 1 life forever start-time now
crypto ipsec transform-set NORMAL esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map ymca 10 match address 101
crypto map ymca 10 set peer x.x.x.x
crypto map ymca 10 set transform-set NORMAL
crypto map ymca 10 set security-association lifetime seconds 28800
crypto map ymca 10 set security-association lifetime kilobytes 4608000
crypto map ymca 20 match address 102
crypto map ymca 20 set peer x.x.x.x
crypto map ymca 20 set transform-set NORMAL
crypto map ymca 20 set security-association lifetime seconds 28800
crypto map ymca 20 set security-association lifetime kilobytes 4608000
crypto map ymca interface outside
crypto map ymca interface failover
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp enable failover
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
no crypto isakmp nat-traversal
!
track 1 rtr 1 reachability
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 failover

ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
!
dhcpd address 192.168.32.20-192.168.32.90 inside
dhcpd dns 192.168.10.2 192.168.16.17 interface inside
dhcpd wins 192.168.16.9 192.168.10.20 interface inside
dhcpd domain 192.168.16.17 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
url-block url-mempool 6000
url-block url-size 4
webvpn
username admin password WU8LYiMfh8jDdytw encrypted privilege 15
tunnel-group DefaultRAGroup ipsec-attributes
isakmp keepalive threshold 3600 retry 2
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect pptp
inspect ipsec-pass-thru
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:cdabbc28ba92a05bc99ea233bf05b798
: end
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top