- copy the config to new device
- rack the new device
- make sure that the switches and VLANs are configured properly
- change routing info if needed
After putting new ASA FW into rack you can connect using serial line but you can't access it over SSH. You getting this error message.
$ ssh 184.108.40.206 ssh_exchange_identification: Connection closed by remote host
Troubleshooting and solution
From serial console access enable debugging:
# debug sshConnect over ssh. You are going to see this logs on console:
Device ssh opened successfully. SSH0: SSH client: IP = '220.127.116.11' interface # = 2 SSH: unable to retrieve default host public key. Please create a defauth RSA key pair before using SSH SSH0: Session disconnected by SSH server - error 0x00 "Internal error"
Searching for 'unable to retrieve default host public key' finds the links in reference sections. To fix this we need:
fw-asa(config)# crypto key generate rsa INFO: The name for the keys will be:
Keypair generation process begin. Please wait...
Once ASA has its own RSA key to use for SSH handshaking the logs from a sucessful SSH session looks like:
fw-asa# Device ssh opened successfully. SSH0: SSH client: IP = '18.104.22.168' interface # = 2 SSH: host key initialised SSH: license supports 3DES: 2 SSH: license supports DES: 2 SSH0: starting SSH control process SSH0: Exchanging versions - SSH-2.0-Cisco-1.25 SSH0: send SSH message: outdata is NULL server version string:SSH-2.0-Cisco-1.25SSH0: receive SSH message: 83 (83) SSH0: client version is - SSH-2.0-OpenSSH_4.3 client version string:SSH-2.0-OpenSSH_4.3SSH0: begin server key generation SSH0: complete server key generation, elapsed time = 1830 ms SSH2 0: SSH2_MSG_KEXINIT sent SSH2 0: SSH2_MSG_KEXINIT received SSH2: kex: client->server aes128-cbc hmac-md5 none SSH2: kex: server->client aes128-cbc hmac-md5 none SSH2 0: expecting SSH2_MSG_KEXDH_INIT SSH2 0: SSH2_MSG_KEXDH_INIT received SSH2 0: signature length 143 SSH2: kex_derive_keys complete SSH2 0: newkeys: mode 1 SSH2 0: SSH2_MSG_NEWKEYS sent SSH2 0: waiting for SSH2_MSG_NEWKEYSSSH0: TCP read failed, error code = 0x86300003 "TCP connection closed" SSH0: receive SSH message: [no message ID: variable *data is NULL] SSH2 0: Unexpected mesg type receivedSSH0: Session disconnected by SSH server - error 0x00 "Internal error"