SOAR - Warm Standby scripts fail with ssh error on AWS servers

Available Languages

Updated:September 29, 2026
Document ID:SPLK048483

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

SOAR On-prem running on AWS

Description

The AWS VPC configuration for the the subnet may have a deny for the ssh port 22.


Investigation

  1. Try to ssh from the standby to the primary using the user ID and password fails timeout to port 22.
  2. Try to ssh from the primary to the secondary using the user ID and password fails with timeout to port 22.
  3. AWS VPC for the private subnet has port 22 deny configured.
  4. Check /etc/ssh/sshd_cofig allows for password authentication on both. Please note that there could be another configuration file under /etc/ssh/sshd_config.d folder and ensure the password authentication is enabled PasswordAuthentication yes 
    


Resolution
Change the AWS VPC configuration for the private subnet to allow on port 22.  Having a port 22 set to deny overrides any allow for the port.

https://docs.splunk.com/Documentation/SOARonprem/6.3.1/Admin/CreateAWarmStandby


    
    


















     

     
    
            
         	

                
Revision History

                

                    
 
                        
                            

                                Revision
                                Publish Date
                                Comments
                            

                            
                                                
                            
          
                                    

                                        
1.0

                                        

                                            
                                                29-Sep-2026
                                            
                                        

                                        
                                            
Initial Release

                                                                    
                                    

          
                            

                        
                    

                

            

        
    








	




    


    

        














 




























    

    

        

    

    
    
     
			
            

























    
    
    
    









            

                

















  
  

  
    
    
    
    
  






            

        
            
            




















  
Was this Document Helpful?

  
    
    
  
  
    
      
      FeedbackFeedback
    
  







            

                

















  
    
  



            


            

                
















    
Contact Cisco

    







            


            
            































    
   
    





            

                























    

	
  	


            


        
            

                
            

        

    

    
        

            
            

















    

            
Related Articles