Anyconnect VPN PING replies from NAT address

Question

I have been attmepting to setup an Anyconnect client to access an internal LAN via an ASA running 8.6(1)2.
The VPN client connects to the ASA successfully, and I get an IP address from the pool on the ASA, so far so good.
I have an issue whereby a ping from a AnyConnect VPN client to an inside host that has a static nat translation is getting a response from the nat (public) address rather than its real (inside) address as below:
C:\ ping 10.191.16.3 (inside host that is natted to lets say 123.123.123.123 on the ASA)
Pinging 10.191.16.3 with 32 bytes of data:
Reply from 123.123.123.123: bytes=32 time=62ms TTL=127
How do I get the response to come from the real address?  Pinging inside hosts that do not have static NAT entries are ok.
Below is what I beleive are the relevant parts of the config..(Let me know if more is needed and I can post)
interface Redundant1
member-interface GigabitEthernet0/1
member-interface GigabitEthernet0/3
nameif InsideNet99
security-level 100
ip address 10.191.99.251 255.255.255.0
object network VPNClients
subnet 10.191.18.0 255.255.255.0
object network inside_network
subnet 10.191.16.0 255.255.254.0
nat (inside,outside) source static inside_network inside_network destination static VPNClients VPNClients no-proxy-arp route-lookup
object network inside_network
nat (inside,outside) dynamic interface
route inside 10.191.16.0 255.255.254.0 10.191.99.254 1
nat (inside,outside) source static 10.191.16.3 123.123.123.123

Answer 1

Hi,
Many thanks for taking the time to reply.
Here is the output you requested...
The only things I have changed are public IP's (I changed the names of a few things in the original post).
FIREWALL-01# sh run nat
nat (InsideNet99,outside) source static fp-private fp-public
nat (InsideNet99,outside) source static tmg-private tmg-public
nat (InsideNet99,outside) source static ex-private ex-public
nat (InsideNet99,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_10.191.18.0_24 NETWORK_OBJ_10.191.18.0_24 no-proxy-arp route-lookup
object network VRF-VLAN2
nat (InsideNet99,outside) dynamic interface
object network VRF-VLAN3
nat (InsideNet99,outside) dynamic interface
object network VRF-VLAN5
nat (InsideNet99,outside) dynamic interface
object network VRF-VLAN12
nat (InsideNet99,outside) dynamic interface
object network WIFIPUBLIC
nat (wifipublic,outside) dynamic interface
object network VRF-VLAN11
nat (InsideNet99,outside) dynamic interface
object network VRF-VLAN17
nat (InsideNet99,outside) dynamic interface
FIREWALL-01#
Other info...
object network fp-public
host ***.***.***.***
object network VRF-VLAN11
subnet 10.191.16.0 255.255.254.0
object network fp-private
host 10.191.16.1
object network tmg-private
host 10.191.16.3
object network ex-public
host **.***.***.***
object network tmg-public
host 123.123.123.123
object network ex-private
host 10.191.16.2
object network NETWORK_OBJ_10.191.18.0_24
subnet 10.191.18.0 255.255.255.0
object-group network DM_INLINE_NETWORK_1
network-object object VRF-VLAN11
The VPN client has address 10.191.18.1, pinging 10.191.16.3 and getting reply from 123.123.123.123 (The public address of 10.191.16.3).
(123.123.123.123 used for purposes of this forum, not real address).
btw, I can PING other devices on 10.191.16.0/23 that do not have static NATs on the ASA and they respond correctly from the real IP.