So the problem is it authenticates and connects, but the clients gets an ip of 172.16.28.20/27 and a default gw of 172.16.28.1/27.
My ASA is at 172.16.28.30/27.