FTD site-to-site vpn

[S891]

Hi there,

Is it a requirement that changes to allowed vpn  traffic prefixes be done at same time on both ends? Would it create trouble with other vpn traffic considering that change is for only new networks being added as interesting traffic.

[Rob Ingram]

@S891 no thats fine (assuming you are adding additional ACE to the existing ACL), it'll just mean the VPN won't work for those new networks until both sides are configured.

[MHM Cisco World]

use object-group 
and when there is new subnet then only add it subnet to object-group, if that what you ask for.
if you ask about the ACL use by IPsec policy then it should MIRROR in both side. 

here there are two ACL. 
one for allow traffic 
other for IPsec Policy