I want to make sure I understand AnyConnect a little better.
I use AnyConnect and connect to my outside address on my ASA, then go on the ASA the AnyConnect traffic will be sourced for the outside interface. Correct?
If correct....then lets go deeper. I have an internal network of 192.168.1.0/24 and 192.168.1.1 is assigned to the ASA on the "inside" interface. My DHCP pool for AnyConnect users is 192.168.1.50-100. So as above a user connects to the outside interface using AnyConnect and gets the IP address 192.168.1.50. (and inside ip) Will his source Interface still be "outside". I believe the answer is yes. If no please explain.
I want to assign a DHCP pool for my AnyConnect users something other than my inside IPs. So what do I need to do make this work. If I only change the DHCP pool how will it route...see below.
I make up a new DHCP pool for AnyConnect users. (This ip pool range is not on any of my devices and it not being advertised by a routing protocol. I literally I only add an random IP range to the AnyConnect DHCP pool)
A user connects to my outside interface and gets an IP from the new pool.
How does it route?
How does it know to go back through the VPN?
I feel like the DHCP pool needs to be from a VLAN that I already have on my network, please explain if I am right or wrong.
Lets dive even deeper...
User Connects Via AnyConnect to my site in Texas. In Texas we have a site to site VPN to New York. The user sends traffic destined to New York. The packets leave the users computer...goes through the AnyConnect to Texas then sees a route to New York going through the Site to Site VPN. Like above if I assign a random DHCP pool to my AnyConnect users how would New York be able to send the packet back to the AnyConnect user with out the random DHCP pool being advertises in Texas or with a static route in NY pointing to Texas.
Same as the above statement but instead of using random IP for my DHCP pool I use my inside IP range in Texas. I feel like this would work and I do understand it but, it leave me with this question for my NAT in Texas....see below:
AnyConnect user connects to my outside interface on my ASA and wants to send a packet to New York.....so I want to not NAT would it look like this?
Source Intf Dest Intf Source IP Destination IP
Outside Outside Internal <I would have my internal IP range in New York here>
Thanks for you time :)
