Hi Jon

I just put Proxy-IP onto in for security reason. In the real config it has our IP info in there.

When we try and Putty we just get a connection timeout on Putty. On our main ASA we get these messages:

Built {inbound|outbound} TCP connection_id for

interface:real-address/real-port (mapped-address/mapped-port) to

interface:real-address/real-port (mapped-address/mapped-port)

Teardown TCP connection id for

interface:real-address/real-port to interface:real-address/real-port duration

hh:mm:ss bytes bytes [reason]

I don't seam to see any message on the remote ASA

Andrew

Sorry, it's a bit early and i'm still trying to catch up on coffee :-)

What is this line doing exactly -

crypto map outside_map interface outsissh Proxy-IP 255.255.255.240 outside

Also, i'm assuming you have created your crypto keys and saved them ?

Jon

I'm not sure what this line does, it was auto created when we did the site to site vpn wizard.

crypto map outside_map interface outside

I thought that the lines ssh Proxy-IP 255.255.255.240 outside and all the ssh lines gaves us putty access.

I tried to remove the crypto map outside_map interface outside line and we just lost vpn access. So I guess its important

Andrew

crypto map outside_map interface outside

yes that line is important - it applies the crypto map to the outside interface. Without it your VPN's won't work as you found out :-)

My confusion was that the line in your config seemed to be "rypto map outside_map interface outsissh Proxy-IP 255.255.255.240 outside" - guess it was just the way it appeared in the text file.

ssh Proxy-IP 255.255.255.255 outside

should indeed allow ssh to the outside interface. So things to check

1) you have created crypto keys and saved them

2) You are not blocking ssh anywhere in the path from your remote site

Jon

Thanks Jon

We have saved he crpto keys and I don't think we are blocking ssh. We casn certainly ssh out to other IPs in from our main ASA. Is there anyway to check if its is being blocked?

When you say you've saved the keys, did you generate your keys on the ASA? Try this:

crypto key generate rsa general mod 1024

Try to ssh into it again. I ran into this problem last week.

HTH,

John

Thansk John

We've tried this command and still no joy

Any other ideas any one?