Bobby,
The crypto ACLs should be defined using a IP as protocol. It will create conflicts if you try to use TCP or UDP.
Now if you need to tight what comes in thru your tunnel, the best way to do this is using ACLs on the internal Interface.
For example on site A, asumming that the F0/1 is your private interface you could something like this to limit the traffic
access-list 150 permit permit tcp host 1.1.1.1 host 2.2.2.2 eq 2222
access-list 150 permit deny ip host 1.1.1.1 host 2.2.2.2
access-list 150 permit permit ip any any
access-list 160 permit permit tcp host 2.2.2.2 host 1.1.1.1 eq 1111
access-list 160 permit deny ip host 2.2.2.2 host 1.1.1.1
access-list 160 permit permit ip any any
int F 0/1
ip access-group 150 in
ip access-group 160 out
Your crypto acl should be
access-list 101 permit ip host 1.1.1.1 host 2.2.2.2 eq.
In other words, the tunnel must be negotiated using IP as protocol, and then you can limit whatever enters/leaves the tunnel by applying an ACL to the private interface, which is the one the that sees the traffic unencrypted.
HTH.
Raga
