I have a VPN and I think something is not right with it the placement of the ACE's for the permit statement. First of all I want to I have ACL's 10, 20, 30, 40, 50 and 60. My 10 ACL has 6 ACE's and I am trying to add ACE 7 and 8 to it. When ever I add my ACE's 7 with the (lines command) It does not place the 2 ACE's I am adding behind line 6 in the 10 ACL. It actually starts all over like it is the first 10 ACL and list my lines as 1 and 2 instead of the 7 and 8 behind the current 10 ACE. Not only that but is put it under ACL 60 which I am concerned that this is why my VPN tunnel is not coming up. Is this causing the ASA to over look my ACE entriees because they are not at the top with the rest of the 10 ACL ACEs? When I do a ping from the source network to the destination network in the to ACE's I added I do not see any hits on my ACE's when I perform a show access-list command.
Placement on the ACL for VPN crypto ACL is not important. What is important for crypto ACL is that it mirror image exactly on the other site of the tunnel.
If you have 10 lines of ACE on this site, the corresponding VPN peer should have 10 lines as well in reverse direction (mirror image).
The placement of the ACE does not need to be the same.