L2L VPN ACL-- passively permits, or aggressively routes the traffic?

[jmaxwellUSAF]

Hello.

Within an ASA5525 policy based L2L VPN configuration, in that config ACL, if I insert the command... 

access-list COMPANY-ACCESS-LIST extended permit ip 10.0.0.0 255.0.0.0 172.16.5.0 255.255.255.0

Will this simply passively permit any traffic from 10.0.0.0/8 to enter this tunnel if it is already routed through the tunnel, or does this aggressively route all 10.0.0.0/8 traffic through this tunnel?

(I worry that I will route my whole enterprise through this tunnel and offline the enterprise.)

Thank you.

[MHM Cisco World · Accepted solution]

It id policy based vpn ? If Yes then acl you use for policy have no effect at all in routing traffic.

You need first to route traffic through the interface that apply vpn on it then vpn will work.