We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface.
Stripped for readability.
interface GigabitEthernet0/0 nameif outside security-level 0 ip address 184.108.40.206 255.255.255.248 interface GigabitEthernet0/1 nameif inside security-level 50 ip address 192.168.50.4 255.255.255.0 interface GigabitEthernet0/2 nameif dmz security-level 50 ip address 220.127.116.11 255.255.255.224 object-group network newprod-hosts network-object host 18.104.22.168 route inside 192.168.60.0 255.255.255.0 192.168.50.1 1
I am trying to PAT
22.214.171.124 port 22 to
192.168.60.20 port 22
object network inside-ssh-host host 192.168.60.20 nat (inside,dmz) static 126.96.36.199 service tcp ssh ssh access-list OUTSIDE extended permit tcp any host 188.8.131.52 eq ssh
However, when I do that, and try to telnet to port 22 on
184.108.40.206 I end up on a server that does not even belong to us and SSH version that I do not expect. Funny thing is, If i remove the ACL listed above, I can no longer access that port, so it is obvious that our ASA is doing something strange.....
% telnet 220.127.116.11 22 Trying 18.104.22.168... Connected to www.<DOMAIN THAT DOES NOT BELONG TO US>.com. Escape character is '^]'. SSH-2.0-OpenSSH_4.3 ^]
Am I doing something wrong here, or do we need to contact our upstream provider to figure out what is happening there?
EDIT: We have recently acquired this DMZ subnet from the upstream provider, but ACL based routing of web traffic to our F5 sitting behind this ASA is working fine.
EDIT 2: When I do
whois on this subnet (
22.214.171.124/27), it returns the information of the previous assignee, who had a larger