Cisco vpn ssh tunnel

PIX/ASA 7.x: SSH/Telnet on the Inside and Outside Interface Configuration Example

Available Languages

Download Options

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Introduction

This document provides a sample configuration of Secure Shell (SSH) on the inside and outside interfaces of Cisco Series Security Appliance version 7.x and later. The configuration of the Series Security Appliance remotely with the command line involves the use of either Telnet or SSH. Because Telnet communications are sent in clear text, which includes passwords, SSH is highly recommended. SSH traffic is encrypted in a tunnel and thereby helps protect passwords and other configuration commands from interception.

The Security Appliance allows SSH connections to the security appliance for management purposes. The security appliance allows a maximum of five concurrent SSH connections for each security context, if available, and a global maximum of 100 connections for all of the contexts combined.

In this configuration example, the PIX Security Appliance is considered to be the SSH server. The traffic from SSH clients (10.1.1.2/24 and 172.16.1.1/16) to the SSH server is encrypted. The security appliance supports the SSH remote shell functionality provided in SSH versions 1 and 2 and supports Data Encryption Standard (DES) and 3DES ciphers. SSH versions 1 and 2 are different and are not interoperable.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on Cisco PIX Firewall Software version 7.1 and 8.0.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Note: SSHv2 is supported in PIX/ASA version 7.x and later and not supported in versions earlier to 7.x.

Related Products

This configuration can also be used with the Cisco ASA 5500 Series Security Appliance with software versions 7.x and later.

Conventions

Refer to the Cisco Technical Tips Conventions for more information on document conventions.

Configure

In this section, you are presented with the information to configure the features described in this document.

Note: Each configuration step is presented with the necessary information to use the command line or the Adaptive Security Device Manager (ASDM).

Note: Use the Command Lookup Tool (registered customers only) in order to obtain more information on the commands used in this section.

Network Diagram

This document uses this network setup:

SSH Configurations

This document uses these configurations:

SSH Access to the Security Appliance

Complete these steps in order to configure SSH access to the security appliance:

SSH sessions always require a username and password for authentication. There are two ways to meet this requirement.

Configure a username and password and use AAA:

Note: If you use a TACACS+ or RADIUS server group for authentication, you can configure the security appliance to use the local database as a fallback method if the AAA server is unavailable. Specify the server group name and then LOCAL (LOCAL is case sensitive). We recommend that you use the same username and password in the local database as the AAA server, because the security appliance prompt does not give any indication which method is used.

Note: You can alternatively use the local database as your main method of authentication with no fallback. In order to do this, enter LOCAL alone.

Use the default username of pix and the default Telnet password of cisco. You can change the Telnet password with this command:

Note: The password command can also be used in this situation. Both commands do the same thing.

Generate an RSA key pair for the PIX Firewall, which is required for SSH:

Note: The modulus_size (in bits) can be 512, 768, 1024, or 2048. The larger the key modulus size you specify, the longer it takes to generate the RSA key pair. The value of 1024 is recommended.

Note: The command used to generate an RSA key pair is different for PIX software versions earlier than 7.x. In earlier versions, a domain name must be set before you can create keys.

Note: In multiple context mode, you must generate the RSA keys for every contexts. In addition, crypto commands are not supported in system context mode.

Specify the hosts allowed to connect to the security appliance.

This command specifies the source address, netmask and interface of the host(s) allowed to connect with SSH. It can be entered multiple times for multiple hosts, networks, or interfaces. In this example, one host on the inside and one host on the outside are permitted.

Optional: By default, the security appliance allows both SSH version 1 and version 2. Enter this command in order to restrict connections to a specific version:

Note: The version_number can be 1 or 2.

Optional: By default, SSH sessions are closed after five minutes of inactivity. This timeout can be configured to last for between 1 and 60 minutes.

How to use an SSH Client

Provide the username and the login password of the PIX 500 Series Security Appliance while you open the SSH session. When you start an SSH session, a dot (.) displays on the security appliance console before the SSH user authentication prompt appears:

The display of the dot does not affect the functionality of SSH. The dot appears at the console when a server key is generated or a message is decrypted with private keys during SSH key exchange before user authentication occurs. These tasks can take up to two minutes or longer. The dot is a progress indicator that verifies that the security appliance is busy and has not hung.

SSH versions 1.x and 2 are entirely different protocols and are not compatible. Download a compatible client. Refer to the Obtain an SSH Client section of Advanced Configurations for more information.

PIX Configuration

This document uses this configuration:

PIX Configuration

Note: In order to access the management interface of the ASA/PIX using SSH, issue this command: ssh 172.16.16.160 255.255.255.255 Management

Configuration with ASDM 5.x

Complete these steps in order to configure the device for SSH using ASDM:

Choose Configuration > Properties > Device Administration > User Accounts in order to add a user with ASDM.

Choose Configuration > Properties > Device Access > AAA Access > Authentication in order to set up AAA authentication for SSH with ASDM.

Choose Configuration > Properties > Device Administration > Password in order to change the Telnet password with ASDM.

Choose Configuration > Properties > Certificate > Key Pair, click Add and use the default options presented in order to generate the same RSA keys with ASDM.

Choose Configuration > Properties > Device Access > Secure Shell in order to use ASDM to specify hosts allowed to connect with SSH and to specify the version and timeout options.

Click File > Save Running Configuration to Flash in order to save the configuration.

Configuration with ASDM 6.x

Complete these steps:

Choose Configuration > Device Management > Users/AAA > User Accounts in order to add a user with ASDM.

Choose Configuration > Device Management > Users/AAA > AAA Access > Authentication in order to set up AAA authentication for SSH with ASDM.

Choose Configuration > Device Setup > Device Name/Password in order to change the Telnet password with ASDM.

Choose Configuration > Device Management > Certificate Management > Identity Certificates, click Add and use the default options presented in order to generate the same RSA keys with ASDM.

Under Add a new Identity certificate click New in order to add a default key pair if one does not exists. Then, click Generate Now.

Choose Configuration > Device Management > Management Access > Command Line (CLI) > Secure Shell (SSH) in order to use ASDM to specify hosts allowed to connect with SSH and to specify the version and timeout options.

Click Save on top of the window in order to save the configuration.

When prompted to save the configuration on flash, choose Apply in order to save the configuration.

Telnet Configuration

In order to add Telnet access to the console and set the idle timeout, issue the telnet command in global configuration mode. By default, Telnet sessions that are left idle for five minutes are closed by the security appliance. In order to remove Telnet access from a previously set IP address, use the no form of this command.

The telnet command lets you specify which hosts can access the security appliance console with Telnet.

Note: You can enable Telnet to the security appliance on all interfaces. However, the security appliance enforces that all Telnet traffic to the outside interface be protected by IPsec. In order to enable a Telnet session to the outside interface, configure IPsec on the outside interface to include IP traffic that is generated by the security appliance and enable Telnet on the outside interface.

Note: In general, if any interface that has a security level of 0 or lower than any other interface, then PIX/ASA does not allow Telnet to that interface.

Note: It is not recommended to access the security appliance through a Telnet session. The authentication credential information, such as password, is sent as clear text. The Telnet server and client communication happens only with the clear text. Cisco recommends to use SSH for a more secured data communication.

If you enter an IP address, you must also enter a netmask. There is no default netmask. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address. In order to limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255.

If IPsec operates, you can specify an unsecure interface name, which is typically the outside interface. At a minimum, you can configure the crypto map command in order to specify an interface name with the telnet command.

Issue the password command in order to set a password for Telnet access to the console. The default is cisco. Issue the who command in order to view which IP addresses currently access the security appliance console. Issue the kill command in order to terminate an active Telnet console session.

In order to enable a Telnet session to the inside interface, review these examples:

This example permits only the host 10.1.1.1 to gain access to the security appliance console through Telnet:

This example permits only the network 10.0.0.0/8 to gain access to the security appliance console through Telnet:

This example allows all networks to gain access to the security appliance console through Telnet:

If you use the aaa command with the console keyword, the Telnet console access must be authenticated with an authentication server.

Note: If you have configured the aaa command in order to require authentication for the security appliance Telnet console access and the console login request times out, you can gain access to the security appliance from the serial console. In order to do this, enter the security appliance username and the password that is set with the enable password command.

Issue the telnet timeout command in order to set the maximum time that a console Telnet session can be idle before it is logged off by the security appliance. You cannot use the no telnet command with the telnet timeout command.

This example shows how to change the maximum session idle duration:

SSH/Telnet Support in the ACS 4.x

If you look at the RADIUS functions, you can use the RADIUS for the SSH functionality.

When an attempt is made to access the security appliance with Telnet, SSH, HTTP, or a serial console connection and the traffic matches an authentication statement, the security appliance requests a username and password. It then sends these credentials to the RADIUS (ACS) server, and grants or denies CLI access based on the response from the server.

For instance, your ASA security appliance 7.0 needs an IP address from which the security appliance accepts connections, such as:

Refer to PIX/ASA : Cut-through Proxy for Network Access using TACACS+ and RADIUS Server Configuration Example for more information on how to configure SSH/Telnet access to PIX with ACS authentication.

Verify

Use this section in order to confirm that your configuration works properly.

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT in order to view an analysis of show command output.

Debug SSH

Issue the debug ssh command in order to turn on SSH debugging.

This output shows that the authentication request from host 10.1.1.2 (outside to PIX) to «pix» is successful:

If a user gives a wrong username, for example, «pix1» instead of «pix», the PIX Firewall rejects the authentication. This debug output shows the failed authentication:

Similarly, if the user provides the wrong password, this debug ouput shows you the failed authentication.

View Active SSH Sessions

Issue this command in order to check the number of SSH sessions that are connected and the connection state to the PIX:

Choose Monitoring > Properties > Device Access > Secure Shell Sessions in order to view the sessions with ASDM.

View Public RSA Key

Issue this command in order to view the public portion of the RSA keys on the security appliance:

Choose Configuration > Properties > Certificate > Key Pair, and click Show Details in order to view RSA keys with ASDM.

Troubleshoot

This section provides information you can use to troubleshoot your configuration.

How to Remove the RSA Keys from the PIX

Certain situations, such as when you upgrade PIX sofware or change the SSH version in the PIX, can require you to remove and re-create RSA keys. Issue this command in order to remove the RSA key pair from the PIX:

Choose Configuration > Properties > Certificate > Key Pair, and click Delete in order to remove RSA keys with ASDM.

SSH Connection Failed

Error message on PIX/ASA:

The corresponding error message on the SSH Client machine:

In order to resolve this issue, remove and re-create the RSA keys. Issue this command in order to remove the RSA key pair from ASA:

Issue this command in order to generate the new key:

Unable to Access ASA with SSH

In order to resolve this issue, complete these steps:

Either reload the ASA or remove all SSH related config and the RSA keys.

Reconfigure the SSH comands and regenerate the RSA keys.

Unable to Access Secondary ASA Using SSH

When ASA is in failover mode, it is not possible to SSH to the standby ASA through the VPN tunnel. This is because the reply traffic for the SSH takes the outside interface of the standby ASA.

Источник