FTD w/Anyconnect - which zone is the (private addressed) VPN pool in?

[lauren]

Possibly a silly question, but I can't find the answer in the guides.

On FTD with an Anyconnect VPN set up for remote access over the Internet.  Anyconnect users get a private address assigned from a VPN pool as normal.

Now when creating a ruleset to allow/deny internal communications with a VPN user on their private address, which zone is the remote user in, inside or outside?

[MHM Cisco World]

Zone to allow traffic ? as I Know the zone of VPN pool is OUTside 

[lauren]

yes, as in wanting to permit/deny from the VPN pool access to/from the internet, servers, add IPS inside the VPN etc.

[Marvin Rhoads]

There is a sysopt command that is often used to exempt VPN traffic from the Access Control Policy. In your remote access VPN setup this appears under the Access Interface tab.

Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/vpn-remote-access.html#task_a4z_xsz_2fb

If that is not selected, the RA VPN traffic falls under the Outside zone for purposes of creating a rule to allow it in the ACP.