If you have already integrated AD + DUO with your anyconnect...Create a DAP for A, B, CCreate ACE, ACL under ACL ManagerA - Access to server A on portB- Access to server B on portC- Access to server B on portthen you have to allow your vpn pool range...