ASA VPN LDAP authentication notes

1. beware use the group that is the user directly belongs to, avoid the recursive list of nested predecessors.
it might won't work if break this rule

2. beware the NAT rule, you need a rule for the VPN