I'm attempting the same... But all with 1 ASA.

I can connect with the anyconnect client just fine get pings back from internal hosts. But I don't get traffic from either public internet or other fixed ipsec tunnels to other sites. Those sites work fine if I'm on site or connected via an old VPN-3005.

I've read some about "hairpining" but unclear that will solve my problem.

Hairpinning is the ability to reroute traffic backout the same interface in which it received that traffic.

Previously, this was not something the Firewalls can do.

Now, the ASA can do hairpinning, which is used to provide Internet access to the VPN clients in most cases.

Normally a VPN client scenario, you will just send the desired traffic through the tunnel (split-tunneling).

You can also send all traffic through the tunnel and provide Internet access through the same ASA.

To accomplish this, the ASA should u-turn the traffic backout to the Internet.

You need something like this:

nat (outside) 1 10.x.x.x 255.255.255.0   --> assuming 10.x.x.x is the pool of addresses assigned for VPN clients

global (outside) 1 interface --> you might already have this for regular Internet traffic (PAT)

same-security permit intra-interface  --> to allow u-turn

Besides that, split-tunneling should be disabled on the ASA.

The routing should be configured accordingly as mentioned earlier.

Federico.