that`s correct, but I would never use "any" config you have used :
access-list 110 permit ip 192.168.195.0 0.0.0.255 any
In my case I have 2 LAN networks :
172.16.0.0 255.255.255.0
10.0.0.0 255.255.255.0
and my vpn clients have the ip pool:
192.168.0.0 255.255.255.0
So I created the ACL as below :
ip access-list extended ACL_CRYPTO_VPN_CLIENTS
deny ip 172.16.0.0 0.0.0.255 192.168.0.0 0.0.0.255
permit ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.0.255
I denied access to VPN clients on the network 172.16.0.0 and permited them access to network 10.0.0.0.
You see? I have not used ANY because if You later add more than one LAN than is it more easy to handle the ACL, more easier to find out who have and who have not permission to access specified networks.
please rate if this helps
cheers
James