Hi,
I wil be difficult to figure out exactly what is going on without a TAC case but here are a couple of pointers that might help you to see what is going on:
1.) Filtered buffered logs on the ASA itself.
To verify if the traffic is dropped on the ASA or not, you can setup buffered logging:
logging buffer-size
logging buffered debugging
logging on
Then, check the IP address which is assigned to your AnyConnect client which is unable to pass traffic and check the entries related to it in the logs:
show logging | i
2.) Check the statistics of the AnyConnect session on the ASA
This command will show you a couple of counters related to your session and might give you a hint of what is wrong:
show vpn-sessiondb detail svc filter a-ipaddress
You can replace a-ipaddress by p-ipaddress or name if you want to filter on public IP of the client or username.
3.) Logs generated by the AnyConnect client itself
If you launch the event viewer from a Windows host where AnyConnect is installed ("eventvwr" command), you'll see that there is a new log type named "Cisco AnyConnect VPN Client". The client will write in there all the logs related to your connection.
If you are using Linux, the logs will either be stored under /var/log/messages or /var/log/syslog.
For OSX, it would be /var/log/system.log.
If you still don't see where the issue is after those steps. my advise would be to open a TAC case to have the issue investigated.
Regards,
Nicolas
