How about Cisco ASA? Today, I had to learn how to do it using CLI and not ASDM since I couldn’t find where the equivalent of aaa authentication ssh console LOCAL and crypto key gen rsa mod 4096 in the ASDM. Since I am really new to Cisco ASA, I am not well-versed in issuing commands under CLI. Mar 11, 2018 This blog post expands on the AnyConnect SSL-VPN configuration, adding support for IKEv2/IPSec and using double authentication (Username/Password and Certificate). ASA Configuration Create a Crypto Keypair crypto key generate rsa label VPNKEY modulus 2048 Create a CA Trustpoint crypto.
- Oct 29, 2018 ciscoasa# crypto key generate rsa modulus 4096 INFO: The name for the keys will be:. Taking and Restoring ASDM Backups. Upgrading ASA and ASDM Images. Adding and Removing Devices from the Meraki Dashboard. Setting Up New Meraki Access Points. Upgrading an ASA ROMMON Version. Configuring a Cisco Router as DHCP Server.
- Nov 20, 2017 hostname(config)# crypto key generate rsa modulus modulussize The modulus (in bits) is 512, 768, 1024, or 2048. The larger the key modulus size you specify, the longer it takes to generate an RSA. We recommend a value of 1024. Step 2 To save the RSA keys to persistent Flash memory, enter the following command.
There are some issues you really can’t foresee until you happen to be in that situation. Management access to a Cisco ASA through a VPN tunnel is one of them. In this article, I will explain the problem and then discuss various solutions.
CCNA Training – Resources (Intense)
We will use the network diagram below for our lab scenario:
In the diagram above, when a remote VPN client connects (via VPN) to the ASA, it should have access to the LAN behind the ASA. This is standard remote access VPN and can be achieved with the following configuration on the ASA:
Having set up the Cisco VPN client on my system, I can connect to the VPN tunnel as shown below:
I have a router on the LAN with an IP address of 192.168.10.10 and I can check that the remote user can ping that router successfully.
Cool! But what happens if I try to ping the inside interface of the ASA?
The ping is not successful. In fact, you cannot access the ASA on that interface using Telnet, SSH, etc. when connected through a VPN tunnel. To show that normal LAN users behind the ASA can ping that interface, I will test from the router that I have on the LAN.
The question then becomes, “How do you manage an ASA that you have terminated a VPN tunnel to?” There are three ways this can be done=.
Solution 1: Allow SSH on the outside interface
This solution allows remote access to the ASA whether or not a VPN tunnel is terminated. Of course, SSH is the preferred method since it is more secure than Telnet. If you have a static public IP address (does not change), you can allow SSH only from that IP address to the ASA.
Some people may not be comfortable with this method since it increases the chances of their network being compromised.
Solution 2: Connect to a LAN device and hop from that device to the ASA
Another way to solve this (which can be quite tedious) is to hop from another device to the ASA. For example, I will configure SSH on my local router, login to the router from the remote user’s machine, and then SSH from there to the ASA. For this to work, we need to allow LAN users (or just the LAN router, whatever works) to SSH to the ASA:
Solution 3: Configure the inside interface for management access
I actually saved the best for the last. According to the Cisco command reference, “To allow management access to an interface other than the one from which you entered the ASA when using VPN, use the management-access command in global configuration mode.”
In our case, we can configure management-access inside so that VPN users that connect from the outside can manage the ASA on the inside interface. This means they will be able to use Telnet, SSH, Ping or ASDM to connect to the ASA. Of course, you also need to explicitly configure the remote-access VPN IP address pool to access the ASA on those different management protocols.
Note: I was very restrictive with my ACL to make sure I only allowed the IP addresses in the VPN pool, i.e. 192.168.20.10 – 20.
With this configuration, I can now ping and even SSH to the ASA’s inside IP address:
Summary
In this article, we have discussed the problem of not being able to manage a Cisco ASA after terminating a VPN tunnel to it. We looked at various ways to get around this issue, including enabling SSH on the public interface of the ASA, hopping from a device on the LAN after terminating the VPN tunnel, and finally, using the management-access command to allow VPN users to manage the ASA on the inside interface.
Crypto Key Generate Rsa Asdm Code
I hope you have found this article helpful.
Further reading
Cisco Switch Can't Generate Crypto Key Rsa
- Cisco ASA Series Command Reference – management-access: http://www.cisco.com/c/en/us/td/docs/security/asa/command-reference/cmdref/m1.html#pgfId-2112283
- NAT and VPN Management Access: http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/nat_overview.html#wp1244792