Pix 6.3 SSH trouble

Sep 12, 2008 4 Replies

Hey guys, recently I tried to ssh to one of my pix 501s and was unable to. I was able to login a few weeks ago and no config changes have been made since. here is the debug output from my ssh client:



ssh -vvv -c des -1 snipped-for-privacy@x.x.1.1 OpenSSH_4.3p2, OpenSSL 0.9.7j 04 May 2006 debug1: Reading configuration data /etc/ssh/ssh_config debug2: ssh_connect: needpriv 0 debug1: Connecting to x.x.1.1 [x.x.1.1] port 22. debug1: Connection established. debug1: Remote protocol version 1.5, remote software version Cisco-1.25 debug1: no match: Cisco-1.25 debug1: Local version string SSH-1.5-OpenSSH_4.3 debug2: fd 3 setting O_NONBLOCK debug1: Waiting for server public key. Read from socket failed: Connection reset by peer



When I ran a tcpdump I see (src: x.x.0.50 remote: x.x.1.1): 1: 14:57:31.422417 x.x.0.50.1032 > x.x.1.1.22: S



3069502965:3069502965(0) win 5840 2: 14:57:31.549043 x.x.1.1.22 > x.x.0.50.1032: S
2586686643:2586686643(0) ack 3069502966 win 4096 3: 14:57:31.549272 x.x.0.50.1032 > x.x.1.1.22: . ack 2586686644 win
5840 4: 14:57:31.678324 x.x.1.1.22 > x.x.0.50.1032: P
2586686644:2586686663(19) ack 3069502966 win 4096 5: 14:57:31.678462 x.x.0.50.1032 > x.x.1.1.22: . ack 2586686663 win
5840 6: 14:57:31.678569 x.x.0.50.1032 > x.x.1.1.22: P
3069502966:3069502986(20) ack 2586686663 win 5840 7: 14:57:31.807605 x.x.1.1.22 > x.x.0.50.1032: R
2586686663:2586686663(0) win 0


Unfortunately I don't have console access to this device as it is at a remote location, just would like to have an idea as to what is going on prior to replacing it. Any suggestions?


Thanks in advance.


jtrooney schrieb:

Hard to tell without access to the device itself, but I have already seen several PIXen spontaneously lose their RSA keypairs. Generating a new one fixed it, and everything ran fine again. No need to replace the unit.

HTH T.

You just have to try an rdp/ssh connection on a machine at the remote site and try to telnet to the pix from there or launch pdm from there. maybe you found it out already

did this pix firewall failed over ?, if so you will need to delete the ssh key from known_hosts file

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required