The ASA supports a feature that lets a VPN client send IPsec-protected traffic to another VPN user by allowing such traffic in and out of the same interface is called “hairpinning”, this feature can be thought of as VPN spokes (clients) connecting through a VPN hub (Cisco ASA firewall).
In another application, this feature can redirect incoming VPN traffic back out through the same interface as unencrypted traffic. This would be useful, for example, to a VPN client that does not have split tunneling but needs to both access a VPN and browse the Web.

For CCNP Security i found the excellent reviews for the book Cisco ASA-All in One checkout the free preview of the book at &