I am having issues getting my anyconnect clients to be able to hairpin. I had this functional on my 5505, and used the same configuration from the 5505 to establish the setup on the 5506. Clients are able to talk to resources on the LAN, but unable to get out to the internet on a hairpin.
"Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside: dst outside: denied due to NAT reverse path failure"
Relevant NAT Rules:
nat (inside,outside) source static any any destination static VPN_Subnet VPN_Subnet no-proxy-arp route-lookup
nat (outside,outside) source static VPN_Subnet VPN_Subnet destination static VPN_Subnet VPN_Subnet no-proxy-arp route-lookup
object network obj_any
nat (any,outside) dynamic interface
nat (outside,outside) after-auto source dynamic VPN_Subnet interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 ************ 1
Any help would be appreciated.
