1

We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface.

Stripped for readability.

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 123.123.6.243 255.255.255.248

interface GigabitEthernet0/1
 nameif inside
 security-level 50
 ip address 192.168.50.4 255.255.255.0

interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 123.123.27.129 255.255.255.224

object-group network newprod-hosts
 network-object host 123.123.27.134

route inside 192.168.60.0 255.255.255.0 192.168.50.1 1

I am trying to PAT 123.123.27.134 port 22 to 192.168.60.20 port 22

object network inside-ssh-host
 host 192.168.60.20

nat (inside,dmz) static 123.123.27.134 service tcp ssh ssh

access-list OUTSIDE extended permit tcp any host 123.123.27.134 eq ssh

However, when I do that, and try to telnet to port 22 on 123.123.27.134 I end up on a server that does not even belong to us and SSH version that I do not expect. Funny thing is, If i remove the ACL listed above, I can no longer access that port, so it is obvious that our ASA is doing something strange.....

% telnet 123.123.27.134 22
 Trying 123.123.27.134...
 Connected to www.<DOMAIN THAT DOES NOT BELONG TO US>.com.
 Escape character is '^]'.
 SSH-2.0-OpenSSH_4.3
 ^]

Am I doing something wrong here, or do we need to contact our upstream provider to figure out what is happening there?

EDIT: We have recently acquired this DMZ subnet from the upstream provider, but ACL based routing of web traffic to our F5 sitting behind this ASA is working fine.

EDIT 2: When I do whois on this subnet (123.123.27.128/27), it returns the information of the previous assignee, who had a larger 123.123.27.128/26 subnet

4
  • Look at this question: networkengineering.stackexchange.com/questions/25174/…
    – Ron Maupin
    Dec 17 '15 at 0:48
  • Do a trace route to that address and post the results. @RonMaupin may be right and someone else is advertising it.
    – Ron Trunk
    Dec 17 '15 at 0:51
  • @RonTrunk @RonMauipn Thank you for replying. I figured out the "problem" and it was caused by complete and embarrassing brain malfunction on my end. What I was trying to do is impossible without PBR, because I was trying to NAT an IP address that did not belong to the ASA. It belonged to the downstream F5 device. And I was getting SSH prompt from the F5. Connected to was showing wrong domain because the ISP never delegated DNS control to us and the old assignee's DNS server was still resolving the PTR record.
    – solefald
    Dec 17 '15 at 2:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 12 '17 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.