>>26
Object group-based ACLs are not supported with IPsec.

http://www.cisco.com/c/en/us/td/docs/ios/sec_data_plane/configuration/guide/15_1/sec_data_plane_15_1_book/sec_object_group_acl.html#wp1132617

たぶんこれ。
現行バージョンでも引きずってるかは不明。