anyconnect hairpin dns doctoring

[P_Tone ATG]

I have Guest interface that I'd like to be able to use AnyConnect from to provide access to the inside network and I'd like to be able to do it without dedicated Guest DNS. I believe the answer to that is DNS doctoring through NAT. However; when I use the ASAs interfaces in a NAT translation with DNS doctoring I get errors stating that the address overlaps with the interface, which is of course true.

What are the NAT rules I need to accomplish this?

ASA 9.1(5)

[Philip D'Ath]

Why not create a rule allowing the guest network access to dns on your internal DNS servers (or external).

And you can enable AnyConnect on the guest interface.

[P_Tone ATG]

External won't work because it points to the outside interface and the ASA can't figure out how to route that from another interaface, I've tried every NAT rule imaginable and I either get a failed to route error or an IP spoofing error. Providing access to internal DNS is possible but I feel like that defeats the purpose of having a separate guest network in the first place.