@Sheraz.Salim I don't remember ever using a crypto ACL attaching an IPS policy to it. Generally speaking the VPN traffic would be trusted'ish. However, nothing wrong with trying to restrict the VPN traffic to only allow what has to be allowed denying everything else. Imo, the most secure way would be turning off the "sysopt connection permit-vpn" and relying on the explicit ACLs that would be applied to the interfaces. That way you are only allow what has to be allowed regardless of how you define your crypto ACLs. The only thing with that is that sometimes this approach is not required and doesn't add any value, other times it would be a bit difficult to manage, but as I said, that would be the most secure way to deal with VPN traffic.
The second approach would be to use VPN-Filter which is a dedicated feature to restrict VPN traffic. The gotcha on this as we already mentioned before, is that the way how the VPN-Filter ACLs are created is flipped around, the source would be the remote subnet and the destination would be the local subnet. The reason behind that is because the VPN-Filter ACLs are applied to the traffic landing into the tunnel, hence the match of the subnets would be inverted. If you tried using extended ACLs with IPS policy applied as crypto ACLs and that worked, then why not? that would also be an option.
