20 Apr

ASA SSH internal error and misleading messages

We all know that error messages may be misleading. Also Internet boards or vendor documentation may not be accurate or helpful, sometimes can even move troubleshooting in wrong area. Simple example from Cisco ASA showing following error message:

%ASA-6-315011: SSH session from 192.168.1.2 on interface Management for user "root" disconnected by SSH server, reason: "Internal error" (0x00)

One would think that there is problem with SSH subsystem. Quick search at Google can confirm suspicious as this error happening when no RSA key is present on system. But if regenerating RSA key over and over using different modulus or changing SSH setting is not helping you doubt that’s correct reason. Truth is that on out-of-the-box ASA this is also a symptom of lack of local AAA authentication. To solve the problem you have to add:

aaa authentication enable console LOCAL 
aaa authentication http console LOCAL 
aaa authentication ssh console LOCAL

So error message was not really related nor giving correct clue what real reason of problem was. Vendors should really work on better and more detailed error messages.

Leave a Reply

%d bloggers like this: