KB ID 0001322
ASA-5505 (config)# domain-name networkjutsu.com ASA-5505 (config)# crypto key gen rsa mod 4096 ASA-5505 (config)# ssh version 2 ASA-5505 (config)# ssh key-exchange group dh-group14-sha1. As you know, it is a good idea to enable SSH and disable Telnet. Since ASA does not enable SSH and/or Telnet by default, you have less to worry about.
Problem
I’ve lost count of the number of times this has happened to me! Most of my colleagues prefer to use the ASDM for remote management, but if (like me) you work at command line, then sometimes people <ahem> forget to generate the RSA keypair when deploying a firewall. Then even if SSH access and AAA is setup correctly, you still can’t get in via SSH. Instead you see the following;
RoyalTS and RoyalTSX: ssh_exchange_identification: Connection closed by remote host.
PuTTY: PuTTY Fatal Error: Server unexpectedly closed network connection.
SecureCRT: Connection closed.
OSX/Linux: ssh_exchange_identification: Connection closed by remote host.
Now at command line you can fix this with a ‘Crypto Key Generate RSA Modulus 2048‘ command, but you can’t get to command line only ASDM.
Solution
On older versions of the ASDM you could generate the keypair in the Identification Certificates section (well you still can but only if you are also generating a certificate request file). 64-bit java. So, as we are command line warriors, lets use the ASDM’s command line!
Tools > Command Line Interface > Multiple Line
Send > Wait a couple of minutes and try again.
REMEMBER: I’m assuming you have SSH setup correctly if not, see the following article;
Related Articles, References, Credits, or External Links
NA
ASA(config)#domain-name cisco
with this command we define domain-name to be used when generating crypto keys.
ASA(config)#crypto key generate rsa label cisco modulus 1024
with this command we create crypto keys on asa, naming it 'cisco' and also defining key size with modulus '1024'.
ASA(config)#ssh 0 0 inside
with this command we define from inside of ASA traffic of ssh will be initiated and with 0 0 we define any ip address and any subnet mask. we can also specify particular ip address and also ip network along with interface name, from where traffic will be initiated.
ASA(config)#username ABCD password ABCD1234 privilege 15
Cisco Asa Generate Crypto Keys
with this command we define username and password for SSH user and also privilege level.
ASA(config)#aaa authentication ssh console LOCAL
Cisco Asa Generate Crypto Key In Windows 10
with this command we define authentication method to be used when any user try to login for SSH and 'LOCAL' key word defines local database to be checked for username and password (LOCAL in capital keys as it is case sensitive), we can also use AAA server using RADIUS or TACACS+ servers for database of user