SSH access issue with an ASA 5520 failover pair

Unanswered Question
Jan 9th, 2009
User Badges:

I have an unusual problem. I am unable to SSH to the primary firewall but I am able to SSH to the secondary. RSA keys are generated, they have been zeroized and re-generated to no avail. The configuration is replicated to both firewalls so I do not believe it is a configuration issue. I have validated the config on both boxes just to be sure. Debug ssh 255 generates no output. The error message I receive from putty is "Server unexpectedly closed network connection". During a failover test I attempted to SSH to the primary (now secondary) and was unsuccessful then as well. I had some crazy thought about load on the box causing an issue. Ok, I admit it I was grasping at straws.. Any help would be greatly appreciated.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
fberryman Fri, 01/09/2009 - 07:36
User Badges:

I cant answer your core question yet, but it might help if we agree on terminology. Your primary pix is always the same physical box. Your secondary pix is always the same box, dictated by the license on the box and the serial cable that runs between them. When you switchover, your ACTIVE box changes from one physical box to the other and the original ACTIVE box becomes the STANDBY box. The primary ip address goes with the box that is currently active, as shown by the show failover command output.

toprock1970 Thu, 02/11/2010 - 10:10
User Badges:

Hi guys,

I'm have the exact same issue using ASA 5510 version 7.0(8).

Has anyone got a definative solution or should I raise this with Tac?

awysocki Fri, 01/09/2009 - 11:33
User Badges:

I had this exact problem myself. After failing over to the backup, I just rebooted the problem ASA, and failed back (making it primary again). This seemed to resolve the SSH access issue. I allowed telnet as a temp work around. I am running 7.2(2). I have not seen this problem yet on the 7.2(4) boxes. I have yet to upgrade to 7.2(4) for that box. I know this doesn't help solve the original problem, but it's likely a bug in the code. I imagine TAC would suggest upgrading, unless you are at the latest, in which case maybe worthy of a tac case.

Ivan Martinon Fri, 01/09/2009 - 15:41
User Badges:
  • Cisco Employee,


This is most likely a bug on the code you have, you might be running out of memory for that block or something, I would advise you to go to your TAC rep.

jsteffensen Tue, 05/12/2009 - 04:10
User Badges:

SSH Access problem on ASA configured with failover is a problem.

Im accessing the ASA with SSH through the VPN tunnel, and as soon as i failover it is no longer possible to access the active firewall using ssh.

Accessing the stand-by firewall by ssh is still no problem.

Im running Software 8.0(4) interim 32.

The only solution to sove this issue is to reboot both firewall's. (both firewalls hast to be booted at the same time)



nomair_83 Wed, 05/13/2009 - 12:40
User Badges:
  • Bronze, 100 points or more

Can u configure virtual mac-address for failover and then try?


This Discussion