Generate Rsa Crypto Key Cisco Command
How I create RSA key and enable SSH access in Cisco VG202, in a Cisco router I use the next commands(but in a VG not exists): conf t. Crypto key generate rsa modulus 1024 ip domain-name domain-name ip ssh version 2 ip ssh time-out 120 ip ssh authentication-retries 3 line vty 0 4 transport input telnet ssh end. I did a little research and found out that if I removed the rsa key by using this command ' crypto key zeroize rsa' and then added the 'crypto key generate rsa generate-keys modulus 1024, then that would work. Any thoughts? No service pad. No service password-encryption. Hostname Sales-SW-ACC2. Ip domain name my.company.come.
Last year, I wrote a post about securing the Cisco IOS SSH server. It also makes sense to create one for Cisco ASA especially when my old post about enabling SSH on Cisco ASA was back in 2012. That blog post didn’t include the advanced configurations that will improve the security of the Cisco ASA SSH server. With this post, I’d like to share the minimum advanced SSH configurations that network engineers should consider adding to their ASA template.
Enabling Cisco ASA SSH server
Before we can connect to our Cisco ASA via SSH, we need to have a checklist of things we need to configure.
- While it’s a good idea to have enable password configured, it is optional for SSH.
- You must have at least one user account locally.
- Configure ASA’s authentication method. The authentication method can be local, RADIUS, or TACACS+.
- Generate RSA key pair.
- Configure ACL to allow a specific IP address or range(s).
Setting enable password
My old post covered how to set enable password. It’s the same command on how to set the enable password, but in the newer ASA software, it uses PBKDF2 to encrypt the password compared to the MD5-based hash in older ASA software.
Generating RSA keys
As covered in my old post, to enable SSH on the ASA, we’ll need to generate RSA key pair first. Current NIST recommendation is to use 2048-bit or above. In this post, I am going to use 4096-bit key pair.
SSH Version
Configuring the Cisco ASA SSH server to accept only version 2 is best practice. The reason for this is because SSHv1 has vulnerabilities. That said, make sure to add this to your ASA template.
SSH Encryption Algorithms
By default, it seems that the ASA’s encryption algorithm is configured to use the medium settings. Unfortunately, I cannot seem to verify it using the show run all command. However, the combination of show ssh and show ssh ciphers does the trick.
Dragon naturally speaking key generator. The client and server negotiate the encryption algorithm. That said, it is possible that the client would pick a weaker cipher. To avoid that, we’re going to specify the use of a safer cipher. According to this thread, the use of EAX or GCM is preferable when available. If not, the use CTR over CBC mode. By specifying the encryption algorithm, we’re telling ASA to only offer the AES-256-CTR mode to any clients that try to connect to it.
Here’s the verbose output of my SSH to a Cisco ASA using the default SSH cipher encryption.
Let’s configure the ASA to only use AES256 CTR mode.
Here’s the verbose output of my SSH connection to a Cisco ASA device using the SSH cipher encryption configuration mentioned above.
SSH Integrity Algorithm
By default, it seems that the ASA’s integrity algorithm is configured to use the medium settings. Unfortunately, I cannot seem to verify it using the show run all command. However, the combination of show ssh and show ssh ciphers does the trick.
The default setting for the ASA SSH integrity algorithm is medium. Which means, it will accept both HMAC-SHA1 and HMAC-SHA1-96. The difference between the two algorithms is the digest length. The HMAC-SHA1-96 is a truncated message digest. From my limited understanding, the HMAC-SHA1-96 is the weakened version of HMAC-SHA1 due to the shortened message digest.
Here’s the verbose output of my SSH to a Cisco ASA using the default SSH integrity algorithm.
Let’s configure the ASA to only use HMAC-SHA1.
Here’s the verbose output of my SSH connection to a Cisco ASA device using the SSH integrity algorithm configuration mentioned above.
SSH Key Exchange
The ASA support two Diffie-Hellman key exchange methods and these are DH Group 1 (768-bit) and DH Group 14 (2048-bit). By default, the ASA is set to use Diffie-Hellman Group 1. Unfortunately, this is below what NIST recommends to use in this day and age.
Here’s a Cisco ASA with default SSH key exchange configuration. I issued the no ssh key-exchange to be sure.
Here’s the verbose output of my SSH connection to a Cisco ASA using the default SSH key exchange.
Let’s configure the ASA to use DH Group 14.
Here’s the verbose output of my SSH connection to the Cisco ASA after changing the key exchange method.
SSH ACL
Restricting remote management to a certain IP address is a best practice. It is also required to add the ACL, or we won’t be able to access the Cisco ASA via SSH. That said, I included the command here.
Final Words
All of the configurations covered here are what I’d say minimum security standard for all Cisco ASA devices. It is, after all, a network security device, so it is a must to secure it properly. Though this post is just a small part of protecting the management plane and network engineers must incorporate other security configurations.
Are you ready to improve your network security?
Let us answer more questions by contacting us. We’re here to listen and provide solutions that are right for you.
NetworkJutsu provides networking and network security consulting services for startups, a more established small and medium-sized business (SMB), or large business throughout the San Francisco Bay Area.
Want to learn more about ASA?
Cisco ASA: All-in-one Next-Generation Firewall, IPS, and VPN Services (3rd Edition)
Cisco ASA for Accidental Administrators: An Illustrated Step-by-Step ASA Learning and Configuration Guide
Disclosure
NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.
Q: I have a Cisco switch in my network, which I can access by hooking up a console cable directly to the device. I like to access the switch remotely using SSH. How can I enable ssh on my Cisco 3750 Catalyst Switch?
A: By default, when you configure a Cisco device, you have to use the console cable and connect directly to the system to access it. Follow the steps mentioned below, which will enable SSH access to your Cisco devices. Once you enable SSH, you can access it remotely using PuTTY or any other SSH client.
1. Setup Management IP
First, make sure you have performed basic network configurations on your switch. For example, assign default gateway, assign management ip-address, etc. If this is already done, skip to the next step.
In the following example, the management ip address is set as 192.168.101.2 in the 101 VLAN. The default gateway points to the firewall, which is 192.168.101.1
2. Set hostname and domain-name
Next, make sure the switch has a hostname and domain-name set properly.
3. Generate the RSA Keys
Crypto Key Generate Rsa 2048
The switch or router should have RSA keys that it will use during the SSH process. So, generate these using crypto command as shown below.
Also, if you are running on an older Cisco IOS image, it is highly recommended that you upgrade to latest Cisco IOS.
4. Setup the Line VTY configurations
Setup the following line vty configuration parameters, where input transport is set to SSH. Set the login to local, and password to 7.
If you have not set the console line yet, set it to the following values.
5. Create the username password
If you don’t have an username created already, do it as shown below.
Note: If you don’t have the enable password setup properly, do it now.
Cisco Crypto Key Generate Rsa
Make sure the password-encryption service is turned-on, which will encrypt the password, and when you do “sh run”, you’ll seee only the encrypted password and not clear-text password.
Rsa Key Cisco Command
5. Verify SSH access
Cisco Switch Can't Generate Crypto Key Rsa
From the switch, if you do ‘sh ip ssh’, it will confirm that the SSH is enabled on this cisco device.
After the above configurations, login from a remote machine to verify that you can ssh to this cisco switch.
In this example, 192.168.101.2 is the management ip-address of the switch.
Generate Rsa Crypto Key Cisco Command Key
If you enjoyed this article, you might also like.
Generate A Rsa Crypto Key
Crypto Key Generate Rsa Cisco Command
Next post: How to Backup Oracle Database using RMAN (with Examples)
Cisco Switch Crypto Key Generate Rsa Command
Previous post: How to Use C++ Single and Multiple Inheritance with an Example