Cannot SSH into ASA - ssh_exchange_identification: Connection closed by remote host

I usually write quiet a bit but I figured I would keep track of these small error messages also. So here it goes .. last week I ran across an issue on one of the ASAs. Here is the error message.

"ssh_exchange_identification: Connection closed by remote host"

How to fix it?

Telnet or console into the ASA and type this in the global config mode.

ASA(config)#crypto key generate rsa modules 1024

Save the config (wr).

That should resolve your issue.

Many more articles to come so ....

Please subscribe/comment/+1 if you like my posts as it keeps me motivated to write more and spread the knowledge.

Configuring ASA NAT - Static 1-1 NAT

This blog will be a continuation of my previous blogtorial about NATs on ASA. One key difference to keep in mind between dynamic and static NAT is that Static NATs allow for the possibility for outside hosts to initiate connection.

Here is our base topology.

Let's get started!!!

Full configuration of the devices can be downloaded here.

Configuring ASA NAT - Dynamic NAT - Object Network NAT

In this blogtorial we will see how we can take an inside LAN subnet and dynamically NAT using a POOL of addresses. Make sure the pool of addresses being used is reachable from the destination.

Here is the topology and the entire config can be downloaded here.

Objective:

Inside LAN (10.1.1.0/24) subnet should be dynamically translated to one of the IP addresses from the POOL (204.11.72.0/24). 

Configuring ASA Active/Standby failvover - ASA High Availability

When will this fail? How can we increase resiliency? How can we achieve close to 100% up-time? Questions one should be asking when designing any system. One way to answer these critical design questions -- redundancy!!. So in this blogtorial we will see how we can deploy two ASAs in a redundant design. When it comes to ASA high availability there are two modes: Active/Active where both ASAs are forwarding traffic and the other is Active/Standby where only the primary ASA is responsible for forwarding traffic and the other is in a hot-standby state waiting to forward traffic soon as the primary one fails. Each mode has its own set of pros and cons. Please review the Cisco website for a full list of Guidelines and Limitations.

Full configurations are located here so you can lab this up in GNS3.

With this in mind, let's get started on this topology.

Configuring ASDM for ASA on GNS3

ASDM is a GUI tool that you can use to configure ASAs. Although I prefer to use CLI, ASDM does come in handy from time to time. In this blogtorial we will see how to configure ASDM so that we can use it to configure ASAs running on GNS3. If you need a primer on how to get ASAs working on GNS3 then see my previous blogtorial.

Overview: 

• Download ASDM image
• Create a Loopback interface
• Connect it to the ASA
• Assign IP addresses
• Download TFTP server
• Copy ASDM image to the ASA
• Install ASA on the computer
• Connect to the ASA using ASDM 

GNS3 - Configuring ASA on GNS3

I generally use GNS3 to emulate routers but recently I have been using it to do some ASA labs. So here is how I emulate ASAs on GNS3.

First thing to take care of is acquiring the ASA images needed to emulate an ASA. Files needed can be downloaded here.

Once you've downloaded the files it is time to configure GNS3 to run the ASA. Follow the screenshots.