拓扑：
ASA配置：
access-list NO_NAT extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0
global (outside) 100 interface
nat (inside) 0 access-list NO_NAT
nat (inside) 100 192.168.100.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 192.168.2.2 1
crypto ipsec transform-set l2ltrans esp-des esp-md5-hmac
crypto dynamic-map dymap 100 match address NO_NAT
crypto dynamic-map dymap 100 set transform-set l2ltrans
crypto dynamic-map dymap 100 set reverse-route
crypto map stmap 10 ipsec-isakmp dynamic dymap
crypto map stmap interface outside
crypto isakmp enable outside
isakmp key cisco address 0.0.0.0 netmask 0.0.0.0
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
R3配置：
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 192.168.2.254
!
!
crypto ipsec transform-set l2ltrans esp-des esp-md5-hmac
!
crypto map stmap 10 ipsec-isakmp
set peer 192.168.2.254
set transform-set l2ltrans
match address l2lvpn
ip access-list extended l2lvpn
permit ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
按照上面的配置写好后，结果发现×××不通，sh crypto isakmp sa无任何信息，ASA上启用debug后，inside口下面的PC发ping包，结果无任何debug显示。在对端路由器上发ping包，在ASA上做debug，出来显示信息了：
问题分析：
在ASA上敲入isakmp key cisco address 0.0.0.0 netmask 0.0.0.0后，sh run如下：
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
RA是用于Remote IPsec ×××（如Easy×××）的积极模式协商，我们使用的L2L，所以导致×××无法建立。
问题解决：
一 删除
tunnel-group DefaultRAGroup ipsec-attributes
二 定义一个L2L的tunnel-group，即
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
说明配置完一定要清理IPSEC SA和ISAMAP SA
