Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Ping is ok, but no SSH connection

Hi everybody,

I have a problem with SSH connection. 

I have a network, which can be pinged and connected by SSH from my laptop. 
And some other machines (in my subnet)can ping this range of network, but can't connect by SSH. 
No access list restrictions. No closed ports from server side. 

And one thing... 

I've checked bu wireshark, and see that, when this machines try to connect by SSH, there is no request out of its Ethernet interface. Ping is ok, again. 
But they can connect by SSH to other machines, from other subnets. 

Which information do you need to investigate and help with this problem? 

  • LAN Switching and Routing
Everyone's tags (1)
11 REPLIES

Hi , What is your NAS

Hi ,

 What is your NAS (network access server) device router/switch/ASA/other ??

 

HTH

Sandy

New Member

We have Nexus Swtiches

We have Nexus Swtiches between source and destination hosts. 

New Member

"I've checked bu wireshark,

"I've checked bu wireshark, and see that, when this machines try to connect by SSH, there is no request out of its Ethernet interface." << Is this machine has Firewall or ACL enabled?

 

rgds,

David Sudjiman

Hall of Fame Super Silver

If the original poster is

If the original poster is able to SSH to the device from his laptop then this demonstrates that SSH is enabled and seems correctly configured (which rules out one of the most common problems).

 

If other devices are able to ping then it seems to demonstrate IP connectivity and correct routing (which rules out another of the common problems).

 

I wonder if the problem might involve versions of SSH and what is configured on the device. If the device specifies version 2 (for example) and the original poster is specifying version 2 but the other devices are using version 1 then it would cause these symptoms.

 

It would be helpful if the original poster would provide the output of show ip ssh and the configuration of the vty ports. It would be even more helpul if the original poster would provide the complete configuration of the device (with sensitive data masked out).

 

HTH

 

Rick

New Member

Hi again, Thanks for your

Hi again, 

Thanks for your replies,

We found the cause of the problem. 

We think the problem is OSPF - HSRP - Asymmetric routing problem ()

Here is the topology:

hsrp_ospf.jpg

We tested SSH from two different hosts. UserA can SSH, USerB can't. Here is tracert output from these two hosts

users.jpg

As you can see from output image, there is two equal cost routes from switch SW and it load balanced the traffic.  

What solution do you offer for automatically resolve this issue? 

 

Thanks. 

Hi , I dont think there is

Hi ,

 I dont think there is network reachability issue . Do you have switch between destination server ?? on vlan 165 . Share me following output

Show Spanning tree vlan 165 from from both sw1 and sw2

show ip arp | in 192.168.165.100

show mac address address-table | in 192.168.165.100

To simulate bring down link connecting to SW2 , ensure only one link to sw-vlan30-sw1-vlan165  , check the SSH connectvity from both users , Similarly perform vice versa by shutingdown link connecting to sw1 . 

 

HTH

Sandy

 

New Member

Hi Sandy,Yes there is no

Hi Sandy,

Yes there is no network reachability issue. Lets explain the issue little bit. 

As you see from users.jpg traffic from UserA goes through SW1 which is active for HSRP group165. Thats why traffic for both direction flows through SW1.

But from UserB traffic goes through SW2 and then return traffic goes through SW1.

Because switch SW load balances traffic - 

SW#sh ip cef exact-route 192.168.41.210 192.168.165.100
10.10.41.210 -> 192.168.165.100 => IP adj out of Vlan30, addr 192.168.30.251

SW#sh ip cef exact-route 192.168.41.198 192.168.165.100
10.10.41.198 -> 192.168.165.100 => IP adj out of Vlan30, addr 192.168.30.249

Ping works from both source, but SSH is not working.

New Member

SW1 and SW2 should have vlan

SW1 and SW2 should have vlan 192.168.165.X shown as connected and not learning this via ospf (vlan30). 

 

How are the SW1 and SW2 connected? L2 or L3?

 

Regards,

David Sudjiman

New Member

Hi David,SW1 and SW2 are N7K

Hi David,

SW1 and SW2 are N7K switches. They have fabricpath configured between them

 

Regards,

Rizvan

8589
Views
0
Helpful
11
Replies