Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
The firewall shows the following error messages that may mislead users in the following cases: 1. Missing route to the SCP server - in this case, the firewall does not have a route to the destination server. firewall# copy scp://user@192.0.2.1//tmp/file flash: Address or name of remote host [192.0.2.1]? Source username [user]? Source filename [/tmp/file]? Destination filename [file]? Accessing scp://user@192.0.2.1//tmp/file... %Error opening scp://user@192.0.2.1//tmp/file (No such device) <======== No such device 2. Connectivity failure to the SCP server due to reasons other than a missing route - in this case, there's no reply from the SCP server: firewall# copy scp://user@192.0.2.1//tmp/file flash: Address or name of remote host [192.0.2.1]? Source username [user]? Source filename [/tmp/file]? Destination filename [file]? Accessing scp://user@192.0.2.1//tmp/file... %Error opening scp://user@192.0.2.1//tmp/file (Permission denied) <======== Permission denied capture capi type raw-data interface inside [Capturing - 172 bytes] match tcp any any eq ssh ciscoasa(config)# show capture capi 2 packets captured 1: 07:04:41.538241 198.51.100.100.35882 > 192.0.2.1.22: S 3665990749:3665990749(0) win 32768 2: 07:04:44.564774 198.51.100.100.35882 > 192.0.2.1.22: S 3665990749:3665990749(0) win 32768
First seen when all of the conditions are true: 1. On Secure Firewall Threat Defense (FTD) the user copies files over Secure Copy Protocol (SCP) on Lina engine (in diagnostic CLI) 2. On Adaptive Security Appliance (ASA) the user copies files over SCP and ciscossh stack is disabled: ciscoasa(config)# show run ssh no ssh stack ciscossh 3. Missing route to the SCP server or connectivity failure to the SCP server due to reasons other than a missing route.
1. On the firewall, check the route to the SCP servers. 2. Using troubleshooting tools, such as captures, verify connectivity to the SCP servers.
In the case of ASA, if ciscossh is enabled, the following error messages are shown in both of the above cases: ciscoasa(config)# show run ssh ssh stack ciscossh copy scp://user@192.0.2.1//tmp/file flash: ssh: connect to host 192.0.2.1 port 22: Connection timed out