NAT takes me to a wrong place

Question

We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface.

Stripped for readability.

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 123.123.6.243 255.255.255.248

interface GigabitEthernet0/1
 nameif inside
 security-level 50
 ip address 192.168.50.4 255.255.255.0

interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 123.123.27.129 255.255.255.224

object-group network newprod-hosts
 network-object host 123.123.27.134

route inside 192.168.60.0 255.255.255.0 192.168.50.1 1

I am trying to PAT 123.123.27.134 port 22 to 192.168.60.20 port 22

object network inside-ssh-host
 host 192.168.60.20

nat (inside,dmz) static 123.123.27.134 service tcp ssh ssh

access-list OUTSIDE extended permit tcp any host 123.123.27.134 eq ssh

However, when I do that, and try to telnet to port 22 on 123.123.27.134 I end up on a server that does not even belong to us and SSH version that I do not expect. Funny thing is, If i remove the ACL listed above, I can no longer access that port, so it is obvious that our ASA is doing something strange.....

% telnet 123.123.27.134 22
 Trying 123.123.27.134...
 Connected to www.<DOMAIN THAT DOES NOT BELONG TO US>.com.
 Escape character is '^]'.
 SSH-2.0-OpenSSH_4.3
 ^]

Am I doing something wrong here, or do we need to contact our upstream provider to figure out what is happening there?

EDIT: We have recently acquired this DMZ subnet from the upstream provider, but ACL based routing of web traffic to our F5 sitting behind this ASA is working fine.

EDIT 2: When I do whois on this subnet (123.123.27.128/27), it returns the information of the previous assignee, who had a larger 123.123.27.128/26 subnet

Answer 1

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 123.123.6.243 255.255.255.248

interface GigabitEthernet0/1
 nameif inside
 security-level 100  // Change the security-level to 100 for inside interface
 ip address 192.168.50.4 255.255.255.0

interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 123.123.27.129 255.255.255.224

object network inside-ssh-host
 host 192.168.60.20

nat (dmz,outside) source dynamic any interface destination static interface inside-ssh-host service ssh ssh

The security-level for the inside interface should be set higher than the dmz interface to indicate higher trust.

In the nat command, we are using the source dynamic keyword to perform PAT. This will translate the source IP address to the interface's IP address (PAT), and then we use the destination static keyword to map the translated address to the internal SSH host.

We are using interface instead of a specific IP address in the source dynamic command to ensure that the ASA uses the IP address of the outside interface for PAT.

The ACL on the outside interface allows incoming SSH traffic to the translated IP address.