Cisco anyconnect VPN router specific public IP via tunnel

Question

I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over VPN, so anyone over cisco anyconnect can access those remote sites.

my remote sites address is 222.222.222.222 and they have whitelisted my VPN outside interface IP 111.111.111.111 (which i am trying to access using anyconnect client from my home)

Cisco ASA version is asa964

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
ip local pool ANYCONNECT-VPN-POOL 10.5.250.10-10.5.250.254 mask 255.255.255.0
!
object-group network obj-NET-PRIVATE
 network-object 10.0.0.0 255.0.0.0
!
object network obj-ANYCONNECT-VPN-SUBNET
 subnet 10.5.250.0 255.255.255.0
!
group-policy GroupPolicy_ANYCONNECT-FOO internal
group-policy GroupPolicy_ANYCONNECT-FOO attributes
 dns-server value 10.10.0.10 10.10.0.11
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-ROUTES-FOO
 default-domain value foo.com
!
access-list ANYCONNECT-ROUTES-FOO standard permit 10.0.0.0 255.0.0.0
access-list ANYCONNECT-ROUTES-FOO standard permit host 222.222.222.222
!
nat (any,outside) source static any any destination static obj-ANYCONNECT-VPN-SUBNET obj-ANYCONNECT-VPN-SUBNET no-proxy-arp route-lookup
!
nat (any,outside) after-auto source dynamic obj-NET-PRIVATE interface

What i am missing here, i can see 222.222.222.222 route getting injected to vpn client but i can't ping or access that ip.

Answer 1

I actually wrote a guide on this exact topic back in 2018 because we (the company I work for) have several clients that are locked down to our HQ public address space, that I needed to be able to connect to over AnyConnect without having to use a jump-box. Here is a copy of my article. It looks like you have the majority of what's needed.

Generally speaking, there are two types of traffic policies when using Cisco AnyConnect: “split-tunnel-policy tunnelspecified” (routing LAN traffic through the tunnel while using the client’s own internet access for browsing the internet), and “split-tunnel-policy tunnelall” (routing ALL traffic through the tunnel – public and private). Recently, I was asked for a hybrid of BOTH of those options at the same time: route LAN traffic over the tunnel but also route explicit PUBLIC hosts over the tunnel, while leaving general public traffic to route through the client’s internet as it normally would when using the tunnelspecified method. It took a little thinking but it wasn’t nearly as complicated to do as you might guess. There was no documentation to be found (by me), of anyone else doing this, so I thought I’d write it up for anyone else that might be in need. Before I proceed, I’d like to list a couple of use-cases for this setup, in case it isn’t clear why one would want this hybrid.

• Management access of remote devices (such as client firewalls or routers) that are restricted to only allow connections from your HQ’s public IP

• Accessing websites that are restricted to only allow access from your HQ’s public IP

The steps below assume that you already have AnyConnect configured on your ASA and are looking to add this functionality. If you are in need of configuring AnyConnect from the ground up, you will find a basic guide here, after which you can return here to mix in this hybrid configuration. First, you’ll need to define some things (if they’re not already defined)

• Add your desired public hosts to the ACL you created when initially setting up split-tunneling

• Create an object-group in which you will add the same public hosts you entered into the aforementioned ACL

• Create an object (not object-group) that defines your AnyConnect IP pool

• A hairpin NAT statement to account for the outbound and return traffic to the aforementioned public hosts

Here are examples of each of the items listed above.

ACL example:

access-list SPLIT-TUNNEL-ACL standard permit host 8.8.8.8
access-list SPLIT-TUNNEL-ACL standard permit host 222.222.222.222

Object example:

object network VPN-Pool-3Net
 subnet 192.168.3.0 255.255.255.0

Object-Group example:

object-group network Internet-Through-AnyConnect
 network-object host 8.8.8.8
 network-object host 222.222.222.222

Hairpin NAT example:

nat (outside,outside) source dynamic VPN-Pool-3Net interface destination Internet-Through-AnyConnect Internet-Through-AnyConnect