Francesco, thanks for the quick reply.
Packet tracer shows next hop of outside interface (going out) and denied by the ACL. So it definitely is not hitting the tunnel default gateway route.
Connections are as follows:
Internet (cable modem) -> NAT router outside interface (has public IP)
NAT router (192.168.150.9/30) -> ASA Outside (192.168.150.10/30)
NAT router (192.168.150.5/30) -> ASA Inside (192.168.150.6/30)
On the NAT router, I NAT the connection from AnyConnect clients out on the Internet on the SSL TCP port I specified to the outside interface of the ASA (this is working, you can see a client connected below). My inside network is on the Inside interface of the ASA through the NAT router. I can ping anything inside, I am guessing because I have specific private RFC1918 routes pointed to the inside (and I see two way flow when I do captures on the inside interface of the ASA). However, connecting to anything outside, it just hits the default route on the ASA and not the tunnel default gateway. It's like it is just ignoring the tunnel default gateway.
VPN# packet-tracer input outside icmp 192.168.100.6 8 0 8.8.8.8
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 192.168.150.9 using egress ifc outside
Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
VPN# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.150.9 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.150.9, outside
S 10.0.0.0 255.0.0.0 [1/0] via 192.168.150.5, inside
S 172.16.0.0 255.240.0.0 [1/0] via 192.168.150.5, inside
S 192.168.0.0 255.255.0.0 [1/0] via 192.168.150.5, inside
V 192.168.100.6 255.255.255.255 connected by VPN (advertised), outside
C 192.168.150.4 255.255.255.252 is directly connected, inside
L 192.168.150.6 255.255.255.255 is directly connected, inside
C 192.168.150.8 255.255.255.252 is directly connected, outside
L 192.168.150.10 255.255.255.255 is directly connected, outside
S 0.0.0.0 0.0.0.0 [255/0] via 192.168.150.5, inside tunneled
VPN# sh vpn-sessiondb anyconnect
Session Type: AnyConnect
Username : test Index : 38
Assigned IP : 192.168.100.6 Public IP : <CUT>
Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License : AnyConnect Premium
Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES256
Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA1
Bytes Tx : 20867 Bytes Rx : 24655
Group Policy : VPN_Internal Tunnel Group : DefaultWEBVPNGroup
Login Time : 21:28:54 CDT Tue Jun 25 2019
Duration : 0h:11m:40s
Inactivity : 0h:00m:00s
VLAN Mapping : N/A VLAN : none
Audt Sess ID : *******
Security Grp : none
