This probably belongs in security, but either way. The networks you enter for remote and local are the only ones encrypted. If the asa receives a packet from the local network described in your configuration to the remote network you specified, it will be sent down the tunnel. If it receives a packet anywhere else, it will route it normally (conditions permitting, of course). These two network statements must match on the remote and local sides (the same networks need to be specified) otherwise phase2 will fail.
Depending on the implementation, you may or may not need to add additional access lists to allow said traffic. If the command "sysopt connection permit-vpn" is enabled (which it is by default), all vpn traffic bypasses any access list. While this isn't very secure, it's easy since you don't need to explicitly allow vpn traffic. If that command is not enabled, and you don't want it enabled, you must write a separate access list permitting the vpn traffic through and apply it to an interface.
