Cisco ASA VPN tunnel shows up (phase 1 and 2, MM_ACTIVE), but no traffic passes

Question

My end of the tunnel is on an ASAv in AWS. (version 9.14)

show crypto isakmp sa

4   IKE Peer: 212.239.x.y
    Type    : L2L             Role    : responder 
    Rekey   : no              State   : MM_ACTIVE 

asav(config)# show crypto ipsec sa peer 212.239.x.y
peer address: 212.239.x.y
    Crypto map tag: outside_map8, seq num: 3, local addr: 192.168.1.13

      access-list outside_cryptomap_client extended permit ip 192.168.10.0 255.255.255.0 host 10.11.0.168 
      local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (10.11.0.168/255.255.255.255/0/0)
      current_peer: 212.239.122.230


      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 192.168.1.13/4500, remote crypto endpt.: 212.239.x.y/4500
      path mtu 1500, ipsec overhead 66(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled
      current outbound spi: 28DDBAD7
      current inbound spi : 8E3584C7

    inbound esp sas:
      spi: 0x8E3584C7 (2385872071)
         SA State: active
         transform: esp-3des esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }
         slot: 0, conn_id: 151, crypto-map: outside_map8
         sa timing: remaining key lifetime (kB/sec): (3915000/3011)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001
    outbound esp sas:
      spi: 0x28DDBAD7 (685619927)
         SA State: active
         transform: esp-3des esp-sha-hmac no compression 
         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }
         slot: 0, conn_id: 151, crypto-map: outside_map8
         sa timing: remaining key lifetime (kB/sec): (3915000/3011)
         IV size: 8 bytes
         replay detection support: Y
         Anti replay bitmap: 
          0x00000000 0x00000001

However in the the debug logs i see this:

IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = outside_map8.  Map Sequence Number = 3.
Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside_map8.  Map Sequence Number = 3.

How can the tunnel be up, but yet refuse to pass traffic?

packet-tracer input inside tcp 192.168.2.203 1065 10.11.0.168 80 detailed

Phase: 8
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7ff8b915de90, priority=70, domain=encrypt, deny=false
        hits=2030, user_data=0x0, cs_id=0x7ff8b98e08d0, reverse, flags=0x0, protocol=0
        src ip/id=192.168.10.0, mask=255.255.255.0, port=0, tag=any
        dst ip/id=10.11.0.168, mask=255.255.255.255, port=0, tag=any, dscp=0x0
        input_ifc=any, output_ifc=outside

Answer 1

There were 4 hosts on the remote side of the tunnel. I had accidentally listed them twice in the object group for the NAT rule. Once I corrected that mistake everything worked.