AnyConnect - How should this traffic be interpreted on the ASA?

[Eric Snijders]

We have a ASA running AnyConnect and this is working fine, but i was wondering how i should interpret traffic coming from the AnyConnect subnet.

For example:

- ASA01 is running the AnyConnect (let's say: 10.0.0.0/24)

- ASA01 has a static route to the 192.168.1.0/24

- ASA01 also has a static NAT for 192.168.1.1 to 172.16.1.1

What will happen when i send a packet from my AnyConnect client (10.0.0.0/24) to 192.168.1.1? Will the ASA first apply the NAT or will it just follow his routing table? I have no idea how i should interpret this since the AnyConnect network isn't a "interface" on the ASA.

[Mohammed al Baqari]

NAT is done befor routing. Depending on your ASA version you either need
nat exempt (prior version 8.3) or twice nat (after 8.3) to exclude
vpn-to-vpn nat