They originate on the outside interface. This is one of my NAT entries for an international site connected via L2L:
nat (inside-office,ISPA) source static Corporate Corporate destination static France France no-proxy-arp route-lookup
ISPA -> translates to outside for most people, 0 security interface
Corporate -> object-group network containing the local/MPLS subnets
France -> object-group network containing the remote site subnets
This applies to the ACLs as well. However you will need to use:
no sysopt connection permit-vpn
Otherwise the VPN traffic will bypass the ACLs.
However you can use a VPN filter instead of placing ACLs on the interface and avoid turning off the
sys opt connection permit-vpn option.
Example may be found here: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml#configs