03-29-2007 08:08 AM - edited 03-11-2019 02:53 AM
Hello, I can't seem to get this working. I would like SSH to work on the outside interface of my PIX 506e. When I use PUTTY to connect, right away it says "server unexpectedly closed the connection." Here is a copy of the config:
: Saved
: Written by enable_15 at 07:41:14.556 UTC Thu Mar 29 2007
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxx
passwd xxx
hostname entsec
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list entsecacl permit tcp any host 192.168.202.254 eq telnet
access-list entsecacl permit tcp any host 192.168.202.254 eq ssh
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.202.254 255.255.255.0
ip address inside 10.200.10.1 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
access-group entsecacl in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.202.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.202.0 255.255.255.0 outside
telnet 192.168.7.0 255.255.255.0 outside
telnet timeout 5
ssh 192.168.7.0 255.255.255.0 outside
ssh timeout 5
console timeout 0
username xxx password xxx encrypted privilege 15
terminal width 80
Cryptochecksum:xxx
03-29-2007 08:18 AM
generate the activation key again by this command:
(config)#ca gen rsa key 1024
also,
if you initialting the request from ,let's say 1.1.1.1 on outside,then please add the follwoing command :
ssh 1.1.1.1 255.255.255.255 outside
just replace 1.1.1.1 with ur ip address,put in the ssh command,generate the activation keys once and that should take care of this.
hth
sushil
03-29-2007 08:32 AM
That worked! Thanks for your help. How would I get telnet working to that same outside interface?
03-29-2007 08:34 AM
telnet does n't work on the outside interface because of the security concerns.you can enable it on inside/dmz though.
telnet 192.168.1.5 255.255.255.255 inside
hth
sushil
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: