Oct 29, 2018 Here’s how to set up SSH on a new ASA out of the box, as well as set up local authentication. Generate ssh key pair. Upgrading ASA and ASDM Images. I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however all users are authenticated regardless of security group membership.
Learning has never been so easy!
This guide will walk you through the basics of hardening SSH access to your Cisco ASA firewall using ASDM. If you're like me, you'd rather have a GUI than spending the day Googling CLI commands.
4 Steps total
Step 1: Login to ASDM
Step 2: Change the default allow SSH version from 1 to 2
Go to Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH
Under SSH Settings, change the value of 'Allowed SSH Version(s)' from 1 to 2.
Step 3: Change the default Diffie-Hellman group from 1 to 14
Remain in Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH
Enable Asdm On Cisco Asa
Under SSH Settings, change the radio toggle of 'DH Key Exchange' from Group 1 to Group 14.
Step 4: Lock down SSH access to the firewall
Remain in Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH
Under 'Specify the addresses of all hosts/networks which are allowed to access the ASA using ASDM/HTTPS/Telnet/SSH', you should add the static IPs of the devices or servers you wish to access the firewall from.
Click Add on the right.
Select the radio button next to SSH.
Generate Ssh Key Putty
![Asa generate ssh key asdm file Asa generate ssh key asdm file](/uploads/1/2/6/0/126079280/660997030.png)
Select 'Inside' as the interface.
Enter the static IP of the device/server.
Enter 255.255.255.255 as the subnet mask.
Click OK. How are private keys generated bitcoin.
Repeat for all remaining devices/servers or specify any outside IPs which are static that require remote access.
WARNING: If your firewall has 0.0.0.0 'any' enabled by default, make sure you save your changes by adding your static IP first before deleting the 'any' entry. Otherwise, your session will disconnect.
You may repeat the last step for hardening access to ASDM as well.
![Generate Generate](/uploads/1/2/6/0/126079280/651726471.png)
Asa Generate Ssh Key
3 Comments
- Sonoraalexthompson4 Oct 16, 2018 at 06:51pmThank you for the guide! For accessing the ASA through SSH, what devices would you recommend connecting from (a server, etc) from a security standpoint?
- Ghost Chilistarg33ker Oct 16, 2018 at 06:56pmI only connect to the ASA from our Hyper-V host.
- Sonora