Configuring Ssh Access; Using An Ssh Client - Cisco 7604 Configuration Manual

Chapter 23 Configuring Management Access

Configuring SSH Access

To configure SSH access to the FWSM, perform the following steps:
To generate an RSA key pair, which is required for SSH, see the
Step 1
page
To identify the IP addresses from which the FWSM accepts connections, enter the following command
Step 2
for each address or subnet:
hostname(config)# ssh source_IP_address mask source_interface
The FWSM accepts SSH connections from all interfaces, including the one with the lowest security
level.
(Optional) To set the duration for how long an SSH session can be idle before the FWSM disconnects
Step 3
the session, enter the following command:
hostname(config)# ssh timeout minutes
Set the timeout from 1 to 60 minutes. The default is 5 minutes. The default duration is too short in most
cases and should be increased until all pre-production testing and troubleshooting has been completed.
Step 4 (Optional) To restrict the version of SSH accepted by the FWSM, enter the following command. By
default, the FWSM accepts both versions.
hostname(config)# ssh version {1 | 2)
For example, to generate RSA keys and let a host on the inside interface with an address of 192.168.1.2
access the FWSM, enter the following command:
hostname(config)# crypto key generate rsa modulus 1024
hostname(config)# write mem
hostname(config)# ssh 192.168.1.2 255.255.255.255 inside
hostname(config)# ssh 192.168.1.2 255.255.255.255 inside
hostname(config)# ssh timeout 30
To allow all users on the 192.168.3.0 network to access the FWSM on the inside interface, the following
command:
hostname(config)# ssh 192.168.3.0 255.255.255.0 inside

Using an SSH Client

To gain access to the FWSM console using SSH, at the SSH client enter the username pix and enter the
login password set by the password command (see the
page
When starting an SSH session, a dot (.) displays on the FWSM console before the SSH user
authentication prompt appears, as follows:
hostname(config)# .
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
12-4.
7-1). By default, the password is "cisco."
"Generating Key Pairs" section on
"Changing the Login Password" section on
Allowing SSH Access
23-3