Cisco ASA Series Cli Configuration Manual page 998

Configuring ASA Access for ASDM, Telnet, or SSH
If you configure Telnet authentication (see the
section on page
database.
Configuring SSH Access
To identify the client IP addresses and define a user allowed to connect to the ASA using SSH, perform
the following steps.
Detailed Steps
Command
Step 1
crypto key generate rsa modulus
modulus_size
Example:
hostname(config)# crypto key generate rsa
modulus 1024
Step 2
write memory
Example:
hostname(config)# write memory
Step 3
aaa authentication ssh console LOCAL
Step 4
username username password password
Step 5
ssh source_IP_address mask
source_interface
Example:
hostname(config)# ssh 192.168.3.0
255.255.255.0 inside
Step 6
(Optional)
ssh timeout minutes
Example:
hostname(config)# ssh timeout 30
Step 7
(Optional)
ssh version
version_number
Example:
hostname(config)# ssh version 2
Cisco ASA Series CLI Configuration Guide
1-4
1-20), then enter the username and password defined by the AAA server or local
Purpose
Generates an RSA key pair, which is required for SSH.
The modulus value (in bits) is 512, 768, 1024, or 2048. The
larger the key modulus size you specify, the longer it takes to
generate an RSA key pair. We recommend a value of 1024.
Saves the RSA keys to persistent flash memory.
Enables local authentication for SSH access. You can
alternatively configure authentication using a AAA server. See
the
section on page 1-20
Creates a user in the local database that can be used for SSH
access.
For each address or subnet, identifies the IP addresses from
which the ASA accepts connections, and the interface on which
you can SSH. Unlike Telnet, you can SSH on the lowest
security level interface.
Sets the duration for how long an SSH session can be idle
before the ASA disconnects the session.
Set the timeout from 1 to 60 minutes. The default is 5 minutes.
The default duration is too short in most cases, and should be
increased until all pre-production testing and troubleshooting
have been completed.
Limits access to SSH version 1 or 2. By default, SSH allows
both versions 1 and 2.
Chapter 1
"Configuring Authentication for CLI and ASDM Access"
"Configuring Authentication for CLI and ASDM Access"
for more information.
Configuring Management Access