topic Re: ssh access issues in General Topics

ssh access issues

KM1895 — Thu, 08 Jul 2021 06:59:13 GMT

hi,

I have a strange challenge on a cluster. SSH access from a specific jump host is not working.

tcpdump shows that the fw receives the syn packet, but doesnt send any replies back. Smartconsole logs also show that the request is accepted, and there are no antispoofing issues.

i can access the fw on ssh from another location, which kinda adds to the whole mystery.

there is nothing logged when running zdebug drop, so for all intent and purposes, the packet is received, then "vanishes" after that.

Anyone seen anything similar before?

Re: ssh access issues

Timothy_Hall — Thu, 08 Jul 2021 12:10:47 GMT

Sounds like the Gaia OS is "eating" the packet, if you run fw monitor do you see the packet at capture points iI then nothing else?

In the Gaia web interface check the Allowed Hosts screen under System Management...Host Access, you probably have some Gaia-based SSH/HTTPS restrictions defined there.

Re: ssh access issues

the_rock — Thu, 08 Jul 2021 14:28:34 GMT

Timothy actually brought up a good point...maybe do fw monitor to see what happens. Allowed Hosts in web GUI could also cause an issue if configured for specific hosts.

Re: ssh access issues

Timothy_Hall — Thu, 08 Jul 2021 14:58:42 GMT

Yes and because the SSH traffic is to the gateway itself, that traffic will always go F2F so no need to disable SecureXL for the traffic to be visible with fw monitor -e.

Re: ssh access issues

Bob_Zimmerman — Thu, 08 Jul 2021 19:06:42 GMT

Would also be worth confirming routing back to the jump host in question. It's possible the firewall is sending the SYN-ACK, just out a different interface than expected. The simplest way to confirm routing is with 'ip route get', like so:

[Expert@LabSC]# ip route get 1.1.1.1 1.1.1.1 via 10.0.1.1 dev eth1 src 10.0.1.253 cache

That output says I will use eth1 to get to that destination, and I will use the gateway address 10.0.1.1. My source for transmitted traffic will be 10.0.1.253.