I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over VPN, so anyone over cisco anyconnect can access those remote sites.

my remote sites address is and they have whitelisted my VPN outside interface IP (which i am trying to access using anyconnect client from my home)

Cisco ASA version is asa964

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
ip local pool ANYCONNECT-VPN-POOL mask
object-group network obj-NET-PRIVATE
object network obj-ANYCONNECT-VPN-SUBNET
group-policy GroupPolicy_ANYCONNECT-FOO internal
group-policy GroupPolicy_ANYCONNECT-FOO attributes
 dns-server value
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-ROUTES-FOO
 default-domain value foo.com
access-list ANYCONNECT-ROUTES-FOO standard permit
access-list ANYCONNECT-ROUTES-FOO standard permit host
nat (any,outside) source static any any destination static obj-ANYCONNECT-VPN-SUBNET obj-ANYCONNECT-VPN-SUBNET no-proxy-arp route-lookup
nat (any,outside) after-auto source dynamic obj-NET-PRIVATE interface

What i am missing here, i can see route getting injected to vpn client but i can't ping or access that ip.


1 Answer 1


I actually wrote a guide on this exact topic back in 2018 because we (the company I work for) have several clients that are locked down to our HQ public address space, that I needed to be able to connect to over AnyConnect without having to use a jump-box. Here is a copy of my article. It looks like you have the majority of what's needed.

Generally speaking, there are two types of traffic policies when using Cisco AnyConnect: “split-tunnel-policy tunnelspecified” (routing LAN traffic through the tunnel while using the client’s own internet access for browsing the internet), and “split-tunnel-policy tunnelall” (routing ALL traffic through the tunnel – public and private). Recently, I was asked for a hybrid of BOTH of those options at the same time: route LAN traffic over the tunnel but also route explicit PUBLIC hosts over the tunnel, while leaving general public traffic to route through the client’s internet as it normally would when using the tunnelspecified method. It took a little thinking but it wasn’t nearly as complicated to do as you might guess. There was no documentation to be found (by me), of anyone else doing this, so I thought I’d write it up for anyone else that might be in need. Before I proceed, I’d like to list a couple of use-cases for this setup, in case it isn’t clear why one would want this hybrid.

  • Management access of remote devices (such as client firewalls or routers) that are restricted to only allow connections from your HQ’s public IP

  • Accessing websites that are restricted to only allow access from your HQ’s public IP

The steps below assume that you already have AnyConnect configured on your ASA and are looking to add this functionality. If you are in need of configuring AnyConnect from the ground up, you will find a basic guide here, after which you can return here to mix in this hybrid configuration. First, you’ll need to define some things (if they’re not already defined)

  • Add your desired public hosts to the ACL you created when initially setting up split-tunneling

  • Create an object-group in which you will add the same public hosts you entered into the aforementioned ACL

  • Create an object (not object-group) that defines your AnyConnect IP pool

  • A hairpin NAT statement to account for the outbound and return traffic to the aforementioned public hosts

Here are examples of each of the items listed above.

ACL example:

access-list SPLIT-TUNNEL-ACL standard permit host
access-list SPLIT-TUNNEL-ACL standard permit host

Object example:

object network VPN-Pool-3Net

Object-Group example:

object-group network Internet-Through-AnyConnect
 network-object host
 network-object host

Hairpin NAT example:

nat (outside,outside) source dynamic VPN-Pool-3Net interface destination Internet-Through-AnyConnect Internet-Through-AnyConnect
  • 1
    Thank you so much for wonderful explanation! It works for me
    – Satish
    May 14, 2020 at 12:23
  • @Satish Great. Glad you got it working. My route table looks huge now because I have so many of these entries in there, but it had to be done.
    – Jesse P.
    May 14, 2020 at 12:32
  • 1
    thank you so much man. I have been working on this problem for a month. I finally found your article and easily dealt with it. thanks, thank you very much Jul 19, 2022 at 7:12
  • @rangolfirango No problem. Glad it helped you. If you can, please upvote my answer.
    – Jesse P.
    Jul 19, 2022 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.