You need to change the configuration of the default configuration command:
connection permit-ipsec
Implicitly permit any packet that came from an IPSec tunnel and bypass the checking of an associated access-list, conduit, or access-group command statement for IPSec connections.
sysopt connection permit-ipsec
Use the sysopt connection permit-ipsec command in IPSec configurations to permit IPSec traffic to pass through the PIX Firewall without a check of conduit or access-list command statements.
An access-list or conduit command statement must be available for inbound sessions.
By default, any inbound session must be explicitly permitted by a conduit or access-list command statement. With IPSec protected traffic, the secondary access list check could be redundant. To enable IPSec authenticated/cipher inbound sessions to always be permitted, use the sysopt connection permit-ipsec command.
with
no connection permit-ipsec
and apply an access-list fot the IPSEC traffic for example:
!
access-list incoming->outside remark ## VPN SITE TO SITE
access-list incoming->outside permit tcp 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0 eq 21
access-list incoming->outside permit tcp 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0 eq 25
!
access-group incoming->outside in interface outside
!
access-list NoNat-INSIDE permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
!
nat (inside) 0 access-list NoNat-INSIDE
!
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#wp1026942
Bye.
