We have a `site-to-site` VPN tunnel to `AWS` which was working great until I added another subnet to the ACL list for interesting traffic which was causing a strange issue. It is only allowing me to add a single ACL subnet for interesting traffic, if I try to add another one then my tunnel goes down. 

[![enter image description here][1]][1]

currently i have the following ACL and its working great!

`access-list ACL-VPN extended permit tcp 10.0.0.0 255.0.0.0 10.100.1.0 255.255.255.0`

but as soon as i add my other public subnet to route data over the VPN tunnel it brought the new tunnel up because it is seeing the new IP for interesting traffic which i can see in `show crypto ipsec sa`, as soon as it see new interesting traffic it drop traffic for old tunnel which is `10.0.0.0/24` subnet. look like it only allow single ACL subnet for interesting traffic, i tried `any` but it is throwing error. 

`access-list ACL-VPN extended permit tcp 60.x.x.x 255.255.255.0 10.100.1.0 255.255.255.0`

How do i route multiple subnet over the existing VPN tunnel? 

This is my crypto map

    crypto map AWS-VPN 1 match address ACL-VPN
    crypto map AWS-VPN 1 set pfs
    crypto map AWS-VPN 1 set peer 34.xx.xx.xx 52.xx.xx.xx
    crypto map AWS-VPN 1 set ikev1 transform-set AWS-ESP-AES-SHA
    crypto map AWS-VPN 1 set security-association lifetime seconds 3600


  [1]: https://i.sstatic.net/GDP8Z.png