Hi,
So you are connection to the ASA first with Cisco AnyConnect VPN and the VPN pool is 192.168.60.2-192.168.60.9
As you want to connect to the network 192.168.50.0/24 with their original IP addresses and not do NAT you need a NAT0 configuration.
It seems you have the following NAT0 configuration for your "inside" interface
nat (inside) 0 access-list inside_nat0_outbound
access-list inside_nat0_outbound extended permit ip 192.168.50.0 255.255.255.0 172.30.1.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any object-group DM_INLINE_NETWORK_1
access-list inside_nat0_outbound extended permit ip 192.168.60.0 255.255.255.0 192.168.50.0 255.255.255.0
It seems to me atleast that you NAT0 rule doesnt include the traffic between 192.168.50.0/24 and 192.168.60.0/24
Have you by any chance added the last "inside_nat0_outbound" ACL line (marked with red) while trying to get this to work?
access-list inside_nat0_outbound extended permit ip 192.168.60.0 255.255.255.0 192.168.50.0 255.255.255.0
To me it seems you would need to reverse the networks in that statement to
access-list inside_nat0_outbound extended permit ip 192.168.50.0 255.255.255.0 192.168.60.0 255.255.255.0
This is because the NAT rule and the ACL is done for the "inside" interface, therefore you need to use the "inside" interface networks as the source address for the NAT0 rule. This will still apply to traffic from the VPN pool to the LAN network of 192.168.50.0/24 also.
This is atleast what it seems to me. Though if I'm correct this would mean you could not at the moment connect to any host on the 192.168.50.0/24 LAN network from your VPN Pool of 192.168.60.0/24?
- Jouni
