Access Lists on IPSEC VTIs (Cisco IOS)

crypto keyring TUNNEL2
  pre-shared-key address x.x.x.x key *******
 
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
 lifetime 28800
!
crypto isakmp policy 1000
 encr aes 256
 authentication pre-share
 group 2
 
crypto isakmp profile TUNNEL2
   keyring TUNNEL2
   match identity address x.x.x.x 255.255.255.255
 
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set crypt esp-3des esp-sha-hmac
crypto ipsec transform-set crypt2 esp-3des esp-md5-hmac
crypto ipsec transform-set STRONG esp-aes 256 esp-sha-hmac
 
crypto ipsec profile TUNNEL2
 set transform-set crypt
 
interface Tunnel2
 description TUNNEL2
 ip unnumbered Vlan1
 ip access-group 135 in
 tunnel source FastEthernet0
 tunnel destination x.x.x.x
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile TUNNEL2
 
interface FastEthernet0
 description WAN-TWCBC-15M
 ip address y.y.y.y 255.255.255.252
 ip access-group 111 in
 ip flow ingress
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map CISCO
 
interface Vlan1
 ip address 10.4.1.1 255.255.255.0
 ip access-group 125 in
 ip access-group 112 out
 ip nat inside
 ip virtual-reassembly
 
access-list 135 remark Generic IPSEC ACL
access-list 135 permit tcp any any established
access-list 135 permit icmp any any echo-reply
access-list 135 deny   ip any any log
 
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
y.y.y.y    x.x.x.x     QM_IDLE           2039 ACTIVE
 
interface: Tunnel2
    Crypto map tag: Tunnel2-head-0, local addr y.y.y.y
 
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer x.x.x.x port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 533099, #pkts encrypt: 533099, #pkts digest: 533099
    #pkts decaps: 413549, #pkts decrypt: 413549, #pkts verify: 413549
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
 
     local crypto endpt.: y.y.y.y, remote crypto endpt.: x.x.x.x
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0
     current outbound spi: 0x2311B1F9(588362233)
 
     inbound esp sas:
      spi: 0x33151404(857019396)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 213, flow_id: Motorola SEC 2.0:213, sibling_flags 80000046, crypto map: Tunnel2-head-0
        sa timing: remaining key lifetime (k/sec): (4377742/34795)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
 
     inbound ah sas:
 
     inbound pcp sas:
 
     outbound esp sas:
      spi: 0x2311B1F9(588362233)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 214, flow_id: Motorola SEC 2.0:214, sibling_flags 80000046, crypto map: Tunnel2-head-0
        sa timing: remaining key lifetime (k/sec): (4380954/34795)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE
 
     outbound ah sas:
 
     outbound pcp sas:
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109: