Hi, You can open the ports though just take in count the security measures such as creating granular and specific rules matching only the necessary source and destinations  

Hi, As you mentioned the right way is to configure a split DNS in that way only the DNS queries matching the FQDN configured on the ASA will be routed over the tunnel to the ASA DNS server configured for the tunnel traffic  You can have more detaile...

Well there is no command to know the number of ACLs or NATs on the ASA you can see more detailed information via ASDM which will show the number of rules you have 

Hi, TCP State bypass will work regardless if using global policy or applied to a specific interface