SSH Configuration on PIX Firewall

This tech-recipe explains configuring encrypted remote sessions to PIX Firewalls with SSH.


Secure SHell (SSH) provides encrypted terminal sessions, along with several other useful features.

The website www.cisco.com has configuration examples for practically everything under the planet, including the start for this one.

To configure a Cisco PIX Firewall to support SSH, enter the following commands:

hostname myfirewall
domain-name mydomain.mytld
ca gen rsa key 1024
ssh 172.18.124.114 255.255.255.255 inside
ssh timeout 60
passwd YourPasswordGoesHere
ca save all

This configuration allows SSH from the 172.18.124.114 address on the inside interface. Change this address to something that makes sense for your network. If desired, you can use this line to allow access from any address on the outside interface:
ssh 0.0.0.0 0.0.0.0 outside

The “ca save all” is important. This command saves the rsa keys.

In order to connect, first get an SSH client. PuttY is a popular one for Microsoft Windows, and SSH clients are packaged with most Linux distributions.

For Linux, the command line (for a pix at IP address 1.1.1.1) is as follows:
ssh -1 -c des pix@1.1.1.1

For Solaris (from Cisco’s website):
./ssh -c 3des -1 pix -v

The Conversation

Follow the reactions below and share your own thoughts.

4 Responses to “SSH Configuration on PIX Firewall”

  1. February 06, 2009 at 2:40 pm, Luigi said:

    how can i enable 3des instead of des ?

    Reply

    • July 12, 2009 at 1:03 pm, Anonymous said:

      how can i enable 3des instead of des ?

      you must have a unrestricted pix licence

      Reply

  2. June 18, 2010 at 8:44 am, Ramki_eee2005 said:

    thnk u it helped so much

    Reply

  3. February 24, 2011 at 10:09 am, Spam said:

    you need to have a 3des-aes license which is free. unrestricted license is not free and does not affect ssh versions.

    Reply

Leave a Reply