Refer to the exhibit. An internal clients behind the ASA are port address translated to the public outside interface that has an IP address of 3.3.3.3. Client 1 and client 2 have established successfu

Same-security-traffic permit inter-interface controls traffic flow between ASA interfaces of the same security level and is unrelated to VPN split-tunnel behavior.

Exclude Network List Below is a split-tunnel option that excludes specific networks from the tunnel, sending internet traffic directly from the client without PAT through the ASA.

Tunnel All Networks forces all client traffic, including internet-bound traffic, through the SSL VPN tunnel to the ASA. Once the traffic exits the ASA's outside interface, PAT translates the source to 3.3.3.3, so any IP-checking website returns that address. Without full tunneling, internet traffic bypasses the ASA entirely and reflects the client's own ISP-assigned IP.

Tunnel Network List Below enables split tunneling for specific subnets only, meaning general internet traffic bypasses the VPN and the ASA's PAT, so the client's own public IP is returned instead of 3.3.3.3.