It's definitely a NAT issue.
You're using a 10.x.x.x network for your VPN client pool and your NAT ACLs translate all traffic coming from the 192.168.x.x network on the inside to the IPv4 address of the FastEthernet4 interface. This means that return traffic to your VPN clients will come from the translated address rather than the actual address and will not cross the VPN back to you.
Given that all of your NAT rules reference an overload on the same WAN interface, I would simplify it and bring it down to one rule so that you can control the order of operations.
Instead of this:
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source list 2 interface FastEthernet4 overload
ip nat inside source list 111 interface FastEthernet4 overload
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 172.17.225.232 0.0.0.7
access-list 2 remark INSIDE_IF=Vlan10
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 192.168.10.0 0.0.0.255
access-list 111 remark CCP_ACL Category=18
access-list 111 deny ip host 192.168.10.1 host 10.10.10.1
access-list 111 deny ip host 192.168.10.1 host 10.10.10.2
access-list 111 deny ip host 192.168.10.1 host 10.10.10.3
access-list 111 deny ip host 192.168.10.1 host 10.10.10.4
access-list 111 deny ip host 192.168.10.1 host 10.10.10.5
access-list 111 deny ip host 192.168.10.1 host 10.10.10.6
access-list 111 deny ip host 192.168.10.1 host 10.10.10.7
access-list 111 deny ip host 192.168.10.1 host 10.10.10.8
access-list 111 deny ip host 192.168.10.1 host 10.10.10.9
access-list 111 deny ip host 192.168.10.1 host 10.10.10.10
access-list 111 permit ip 192.168.10.0 0.0.0.255 any
Try something like this:
ip nat inside source list ACL_NAT_WAN interface FastEthernet4 overload
!
object-group network OG_RFC1918
10.0.0.0 /8
172.16.0.0 /12
192.168.0.0 /16
!
ip access-list extended ACL_NAT_WAN
deny ip object-group OG_RFC1918 object-group OG_RFC1918
permit ip object-group OG_RFC1918 any
In most cases, you're going to want to ensure that NAT doesn't happen between private IPv4 addresses and public ones while at the same time making sure that NAT does happen between private IPv4 addresses and public ones. The above configuration simplifies this and won't require you to go back and edit the NAT configuration every time you make a change.
