I am adding the restrictions as an ACL in IPSEC rules.

I edited out the addresses that I don't want out there. But the xx.xxx.150.17 address is the address of their PIX, the 192.168.49.0 is the subnet that I am allowing and xxx.xx.176.22 is the address he is trying to connect to.

I one line of the ACL that I have here is:

access-list outside_cryptomap_260 line 2 extended permit tcp host xxx.xx.176.22

192.168.49.0 255.255.255.0 eq telnet (hitcnt=0)

What I am not clear on is why we are seeing the PIX address there instead of the 192.168.49.0 addresses when they try to telnet.

This is not the correct way to filter the traffic in the tunnel.

Leave your cryptomap acls as...

access-list outside_cryptomap_260 extended permit ip host xxx.xx.176.22 192.168.49.0 255.255.255.0

and on the other end...

access-list outside_cryptomap_260 extended permit ip 192.168.49.0 255.255.255.0 host xxx.xx.176.22

To filter the traffic you can either remove "sysopt connection permit-ipsec/vpn" and use your interface acl's to filter the traffic.

Another option in the ASA is to use a vpn-filter. This link is for remote access vpn but it works for l2l as well.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

Thanks...I was starting to come to the conclusion that was the wrong place to set the restrictions, but I didn't know where to look.