Routing between the instances in AWS

Routing of traffic to a VPN concentrator is done in the same way routing is done to a NAT instance.

• Disable the IP source/dest check on the target instance to allow the traffic through, and then

• use the VPC routing tables (not static routes in individual instances) to forward the traffic to the VPN concentrator by its instance-ID/elastic network interface-ID.

The instances using such a route as their default route will, of necessity, only have private IP addresses assigned.

There is no native support in VPC for what you need.

The root of the problem is that VPC's Hardware VPN isn't really designed for connections to third party networks. It's designed for interconnecting to your VPC to your physical data center network -- a trusted connection. A VPC VPN connection is effectively wide open, subject only to the limitations of your security groups and Network ACLs -- it doesn't have a route table or any filtering of its own, and has some other limitations, so it's really not the best choice for external connections. For connections to your data center, of course... it's excellent.

As we found for outgoing connection, the only way is Cisco AnyConnect

That isn't the only way... but it does have to be done with an EC2 instance running IPSec VPN software. There are three packages I'm familiar with, all of which are similar: openswan, libreswan, and strongswan. You can build your own tunnel server.

If you go this route, it's a little bit tricky to get the IP addresses configured correctly, but it's a viable solution. This is how I establish IPSec with external companies.

The circumstances aren't the same, but the idea of your address being split between the instance's private IP and the instance's Elastic IP (EIP) would be similar to what I suggested for the "left" side ("our" side, by my convention) in Strongswan VPN tunnel between two AWS instances won't connect:

left=10.10.10.10         # instance private IP of local system
leftsourceip=10.10.10.10 # instance private IP of local system
leftid=203.x.x.x         # elastic IP of local system
leftsubnet=10.x.x.x/xx

Alternately, there are probably other offerings in the AWS Marketplace that will provide you with an EC2 instance that terminates IPSec tunnels... but there isn't another alternative, unless you have an offsite hardware gateway, outside of AWS, and you want to spoke both a VPC Hardware VPN connection and your third-party connections out of that device.