Hello Jesse,
“I'm giving out DHCP to this SSL VPN client from the server inside the ASA's network so the SSL client is on the same network subnet as the remote LAN.”
Recommendation:
In order to avoid an overlap of IP addresses in the network, assign a completely different pool of IP addresses to the VPN Client (For example, 192.168.10.x).
This requires some routing changes within your network.
About your specific request, If your goal is to handle the Internet traffic through the ASA you might want to configure VPN on a Stick, and you achieve it configuring Hairpining .
E.g
The hairpining feature is useful for VPN traffic that enters an interface but is then routed out of that same interface.
1. same-security-traffic
Use the same-security-traffic command in order to allow traffic to enter and exit the same interface.
securityappliance(config)#same-security-traffic permit intra-interface
2. NAT
The goal is that the traffic coming from the SSL Clients (192.168.10.0) can be translated with an outside IP address (in case you have one available) or the interface itself.
ciscoasa(config)#global (outside) 1 interface
!—Use the interface as the translated IP.
ciscoasa(config)#nat (inside) 1 0.0.0.0 0.0.0.0
!—This translates the inside network to the interface IP.
ciscoasa(config)#nat (outside) 1 192.168.10.0 255.255.255.0
!—This translates the pool network to the interface IP.
The rest is working fine as you described before.
Regards,
Marco Vega
