Cisco ASA – Gernerate RSA Keypair From ASDM

KB ID 0001322 

Problem

I’ve lost count of the number of times this has happened to me! Most of my colleagues prefer to use the ASDM for remote management, but if (like me) you work at command line, then sometimes people <ahem> forget to generate the RSA keypair when deploying a firewall. Then even if SSH access and AAA is setup correctly, you still can’t get in via SSH. Instead you see the following;

RoyalTS and RoyalTSX: ssh_exchange_identification: Connection closed by remote host.

RoyalTSX Disconnected broken pipe

PuTTY: PuTTY Fatal Error: Server unexpectedly closed network connection.

PuTTY Server unexpectedly closed

SecureCRT: Connection closed.

SecureCRT Connection Closed

OSX/Linux: ssh_exchange_identification: Connection closed by remote host.

SSH connection closed by remote host

Now at command line you can fix this with a ‘Crypto Key Generate RSA Modulus 2048‘ command, but you can’t get to command line only ASDM.

Solution

On older versions of the ASDM you could generate the keypair in the Identification Certificates section (well you still can but only if you are also generating a certificate request file). So, as we are command line warriors, lets use the ASDM’s command line!

Tools > Command Line Interface > Multiple Line 

conf t
crypto key generate rsa modulus 2048 noconfirm

Send > Wait a couple of minutes and try again.

Generate Identity Certificate from ASDM

REMEMBER: I’m assuming you have SSH setup correctly if not, see the following article;

Cisco ASA – Allow Remote Management

 

Related Articles, References, Credits, or External Links

NA

Author: PeteLong

Share This Post On

4 Comments

  1. Hey Pete,
    Thanks for this! The command line text has a typo I think.

    I think it should be:
    “crypto key generate rsa modulus 2048 noconfirm”

    Post a Reply
    • Well spotted! – Updated
      ThanQ
      P

      Post a Reply
      • Hi Pete – great article, just got me out of a bind! Thanks 🙂

        Also, there’s still a typo in the ‘Solution’ section referencing 2018 instead of 2048 (in the text snippet).

        Thanks again!
        Mike

        Post a Reply
        • Cheers Mike – ‘Fixed’, Glad I could help you out.

          Post a Reply

Leave a Reply to PeteLong Cancel reply

Your email address will not be published. Required fields are marked *