If you see that traffic is coming from the client to the ASA in the capture that Marvin has suggested, then I am wondering if the NAT configuration on your ASA is causing this issue.
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static Net_10.10.0.0 Net_10.10.0.0 destination static VPN-Pool VPN-Pool
nat (inside,outside) source static Net_10.11.0.0 Net_10.11.0.0 destination static VPN-Pool VPN-Pool
nat (inside,outside) source static Net_192.168.0.0 Net_192.168.0.0 destination static VPN-Pool VPN-Pool
nat (inside,outside) source static Net_172.16.0.0 Net_172.16.0.0 destintion static VPN-Pool VPN-Pool
I am thinking your dynamic NAT is overriding your twice NAT since it is configured in "section 1" of the NAT table. This section matches on a top bottom first match basis. You can correct this by doing one of two things: Configure it in section 2 (auto NAT), or configure it in after auto.
Section 2 config:
object network DYNAMIC
subnet 0 0
nat (inside,outside) dynamic interface
When you do a show run now, you should see that the NAT statement is placed under an object group. It will look something like the following:
object network DYNAMIC
nat (inside,outside) dynamic interface
After auto config:
nat (inside,outside) after-auto dynamic source any interface
With the after auto option you need to be sure that the dynamic statement is at the bottom of the list if you have any other static NATs configured here.
--
Please remember to rate and select a correct answer
--
Please remember to select a correct answer and rate helpful posts
