Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Have you collected DART and checked if there is anything wrong there? You can share the DART bundle here for people to analyze if you are comfortable with it.
Run a packet tracer on outside to any of the unused AnyConnect pool ip and 8.8.8.8 to see what are the phases the packet is going through, and check if your NAT exempt is being hit.
1. You need to have the issuer certificate (the one who signed the user certificate) enrolled in FMC (Devices -> Certificates)
2. Use Certificate authentication in connection profile.
