请教asa 5540 L2L和remote access vpn怎么共存？

crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap interface outside
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
, |1 M. q( `+ B9 Wcrypto map vpnpeer 60 set peer 1.1.1.1
crypto map vpnpeer 60 set transform-set idctofordtrans
crypto map vpnpeer 60 set security-association lifetime seconds 3600
& ?0 G* R, I3 Zcrypto map vpnpeer 60 set security-association lifetime kilobytes 4608000
4 S  W' o( k- f" acrypto map vpnpeer interface outside
; n4 |7 D5 ?. E9 ^" o1 p
' e; N! X3 j3 v9 k( ?红色的两句不能共存，
crypto map mymap interface outside，remote正常
crypto map vpnpeer interface outside，L2L正常

把vpnpeer改成mymap试试呢，这个interface上应该只能绑一条MAP，
/ H( R! i. c0 ], Amap名称后面不一样就可以了，比如说mymap 后面是1，而vpnpeer后面是60，把vpnpeer改成mymap应该不会有影响。

来看一看。。。有些看不懂哦。

crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap 60 set peer 1.1.1.1
3 J  q$ L7 d0 S, \* gcrypto map mymap 60 set transform-set idctofordtrans
crypto map mymap 60 set security-association lifetime seconds 3600
( U2 m3 E4 `' m0 ]. d( Y; Ucrypto map mymap 60 set security-association lifetime kilobytes 4608000
crypto map mymap interface outside
$ @( g2 U5 f! ^' j( c" f  x7 d7 ^是改成这样吗？

了解了解
森林舞会遥控器
大金鲨遥控器
金鲨银鲨遥控器
& a' i( @6 }# k8 _1 U飞禽走兽遥控器
/ S8 ]8 s0 o. A* J$ ?) n# G龙机遥控器
大白鲨遥控器
万能鲨鱼遥控器

你试试呢，结果怎么样？我们这边建立多条VPN是这么做的，当时问过工程师的，说只能绑一个map

crypto map mymap 65535 ipsec-isakmp dynamic dyn1

给你一个例子：
+ Y+ y4 B  I: J- J
  X2 d% B/ ?) }) p1 W5 HASA Version 8.2(1)
!
$ j9 {3 [$ S$ f  u( _3 x* Mhostname ciscoasa
' M0 U" X/ I) ]/ j* Tenable password rNbKiTOk0JO4x8Zm encrypted
passwd rNbKiTOk0JO4x8Zm encrypted
5 M& x: Y. |* M5 ^/ C" @. u2 j$ G  @names
8 `. K3 ^' f+ }% p' Q!
5 Z! V$ ?* _7 S$ s& W; U# @interface GigabitEthernet0/0
nameif inside
security-level 100
# m  v! L( l" P$ |7 ? ip address 172.168.200.1 255.255.255.0
# b" A: Y% J* p, ^) }6 D. g. N( B!
interface GigabitEthernet0/1
0 g3 c5 v* b9 t, S nameif outside
security-level 0
2 _$ F  e8 n9 Z' i) x( Y ip address 218.×.×.× 255.255.255.192
!
+ a. ^3 h& ]+ P# Y8 `- ?interface GigabitEthernet0/2
2 k" @2 t& k9 q( @" K% O3 d shutdown
9 U7 G2 l9 Y% A# q no nameif
no security-level
no ip address
" d* A# T) A( e7 K! V( `7 Q1 T!
interface GigabitEthernet0/3
shutdown
, M4 d* c8 W) A4 u5 Q' J# ` no nameif
+ j1 C4 V2 x  @, r no security-level
- C8 L$ n; D  O# h: P$ U1 F6 F; x no ip address
!
. c/ `" q3 j8 t# }* `6 vinterface Management0/0
& u" ^- t  y4 L. W1 ~4 K+ C# e nameif management
security-level 100
no ip address
4 d0 O: F' e% [) U8 @/ z management-only
" q* P0 e" h9 k!
( G% {# H, u8 h! S& k3 Qftp mode passive
access-list 100 extended permit ip any any
access-list nonatvpn1 extended permit ip 192.168.1.0 255.255.255.0 192.168.6.0 255.255.255.0
: Z1 [. O, b1 w: ^% r" G1 h4 laccess-list nonatvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.6.0 255.255.255.0
: y! ^# M/ f/ @  X  Zaccess-list nonatvpn1 extended permit ip 192.168.3.0 255.255.255.0 192.168.6.0 255.255.255.0
access-list nonatvpn1 extended permit ip 192.168.1.0 255.255.255.0 192.168.221.0 255.255.255.0
access-list nonatvpn1 extended permit ip 192.168.2.0 255.255.255.0 192.168.221.0 255.255.255.0
& K  W% _8 D6 \9 N4 z' m5 Naccess-list nonatvpn1 extended permit ip 192.168.3.0 255.255.255.0 192.168.221.0 255.255.255.0
access-list nonatvpn1 extended permit ip 192.168.1.0 255.255.255.0 11.11.11.0 255.255.255.0
access-list nonatvpn1 extended permit ip 192.168.2.0 255.255.255.0 11.11.11.0 255.255.255.0
access-list nonatvpn1 extended permit ip 172.16.3.0 255.255.255.0 11.11.11.0 255.255.255.0
+ O5 [, |. y% }$ X; L9 `access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.6.0 255.255.255.0
access-list vpn extended permit ip 192.168.2.0 255.255.255.0 192.168.6.0 255.255.255.0
) y, A  o9 o6 N0 V/ Zaccess-list vpn extended permit ip 192.168.3.0 255.255.255.0 192.168.6.0 255.255.255.0
access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.221.0 255.255.255.0
access-list vpn extended permit ip 192.168.2.0 255.255.255.0 192.168.221.0 255.255.255.0
access-list vpn extended permit ip 192.168.3.0 255.255.255.0 192.168.221.0 255.255.255.0
, A2 R; x3 O. h" ^8 Iaccess-list soft extended permit ip 192.168.1.0 255.255.255.0 11.11.11.0 255.255.255.0
/ j+ B6 q2 E  N# faccess-list soft extended permit ip 192.168.2.0 255.255.255.0 11.11.11.0 255.255.255.0
, V2 f! L# ^% maccess-list soft extended permit ip 192.168.3.0 255.255.255.0 11.11.11.0 255.255.255.0
0 [# ^. W+ o, ~pager lines 24
logging enable
logging asdm informational
7 ~! |& v3 l' A4 j% r7 a$ b: v0 e2 gmtu inside 1500
mtu outside 1500
! ~, z9 N% c5 U; G& j2 Rmtu management 1500
ip local pool softvpn 11.11.11.1-11.11.11.254 mask 255.255.255.0
! U+ N7 E" P! Tno failover
4 J5 }5 ]7 G9 f3 ^icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
$ T9 R! T4 p3 v9 ~- Gglobal (outside) 1 interface
  i& D$ ?! j: Fnat (inside) 0 access-list nonatvpn1
nat (inside) 1 0.0.0.0 0.0.0.0
static (outside,outside) 218.249.167.68 172.30.100.2 netmask 255.255.255.255
access-group 100 in interface outside
access-group 100 out interface outside
* e: c7 B7 m: B: Y( M2 Hroute outside 0.0.0.0 0.0.0.0 218.*.*.* 1
route inside 172.168.201.0 255.255.255.0 172.168.200.2 1
route inside 192.168.1.0 255.255.255.0 172.168.200.2 1
+ Z3 i$ P2 B. P6 p9 {7 Eroute inside 192.168.2.0 255.255.255.0 172.168.200.2 1
; f$ ]: k, A* \* T# Xroute inside 192.168.3.0 255.255.255.0 172.168.200.2 1
, P1 g  I. K1 N- _# B  Ztimeout xlate 3:00:00
) j* V9 r' I' h+ B1 P8 w8 {: Atimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
/ @: V4 ~  Q3 i" n8 ^3 ntimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
8 o* q  [6 i. K- x7 Y6 Stimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
2 F0 P$ c4 S2 \( d+ `+ khttp server enable
' W$ z0 g6 j. D( R- hhttp 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
, F" \0 B7 B4 M( K& o( e6 |snmp-server enable traps snmp authentication linkup linkdown coldstart
/ i. L9 S, J" M  O* ncrypto ipsec transform-set cisco esp-des esp-sha-hmac
crypto ipsec transform-set SOFT esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
( c% l( P: @8 @$ o/ kcrypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map softvpn 10 set transform-set SOFT
2 r( S5 v6 e, Bcrypto dynamic-map softvpn 10 set security-association lifetime seconds 28800
9 |  i6 k8 W6 M: ^+ ~crypto dynamic-map softvpn 10 set security-association lifetime kilobytes 4608000
; O- Y% |/ E: I) t  M9 j# wcrypto dynamic-map softvpn 10 set reverse-route
crypto map IPSec_map 1 match address vpn
crypto map IPSec_map 1 set peer 124.*.*.*
- V4 M# q. e1 m* a. @' ?crypto map IPSec_map 1 set transform-set cisco
crypto map IPSec_map 10 ipsec-isakmp dynamic softvpn
1 h% \, Z, m8 I1 T) Mcrypto map IPSec_map interface outside
crypto isakmp enable outside
% l0 Z8 G4 V3 q7 b% _, F& G8 Mcrypto isakmp policy 10
% O& \2 ^3 q. D3 e4 k' ^ authentication pre-share
encryption des
hash sha
group 1
2 ^0 B* `3 X/ r! n lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption des
0 K5 `, @6 r& E7 A; X# j) \: G; z* D hash md5
/ P' b; P: Q# ]+ L group 2
lifetime 86400
0 y2 j- }, {* G. U3 ktelnet 0.0.0.0 0.0.0.0 inside
3 a- i6 Y1 b- A( t% g1 C5 ftelnet timeout 30
+ e2 \" Q; u$ j8 _ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 30
/ D9 u( S, P5 u+ _7 J+ c4 [/ R: hconsole timeout 0
threat-detection basic-threat
6 O+ h8 X2 p- |6 ^threat-detection statistics access-list
no threat-detection statistics tcp-intercept
, P' h( v0 k$ h- k/ X5 Sssl encryption des-sha1
webvpn
group-policy softvpn internal
group-policy softvpn attributes
+ k+ H0 p* ^  O+ V) g/ E" a0 i split-tunnel-policy tunnelspecified
split-tunnel-network-list value soft
username vpn1 password Qr9Uo2I.DinqQ9V/ encrypted privilege 0
& I- k1 }" G& e9 s+ j* S6 Iusername cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
tunnel-group 124.*.*.* type ipsec-l2l
tunnel-group 124.*.*.* ipsec-attributes
pre-shared-key *
tunnel-group softvpn type remote-access
* A" H( \# n* ~! ?$ T/ p( R4 Htunnel-group softvpn general-attributes
address-pool softvpn
default-group-policy softvpn
tunnel-group softvpn ipsec-attributes
pre-shared-key *
, }6 B9 F& N. l& W- m, P0 q* Q!            
+ p8 f' N5 F# F* ]class-map inspection_default
8 N, D: i) h/ w/ }  S/ y match default-inspection-traffic
!
+ k" b! G% M0 b- h1 g  c1 F7 o!
policy-map type inspect dns preset_dns_map
/ v" W  q. Q. c* [: _, q parameters
  message-length maximum 512
; p& E; B0 L- b' ?policy-map global_policy
class inspection_default
3 h% H* P, l6 H! d  inspect dns preset_dns_map
/ n9 q7 Y7 T& f' E# ~/ d+ J/ `  inspect ftp
  inspect h323 h225
/ [% g6 [. C+ m  inspect h323 ras
  inspect rsh
  inspect rtsp
5 l" A) X( j% c" H( I/ b  inspect esmtp
+ H' ?: {( O- a5 Q, _; Z7 C3 L  inspect sunrpc
/ m! K) a; w' j! u  inspect xdmcp
  inspect sip  
; ^4 e+ ~9 S* y0 p  inspect netbios
6 k8 t( m/ C  q! a3 I9 I4 R- g  inspect tftp
  inspect sqlnet
' ^0 H7 S; o3 n5 b! H3 M!
3 c# G" R" x& O0 u/ D- Jservice-policy global_policy global
; G+ @2 s) ~- Y. Z- X5 Oprompt hostname context
Cryptochecksum:3a4e5a02c3417e203a37894b6f3aacdb
8 _( h5 i0 O7 `' J" L, \: end
/ C0 i- I/ A& ?/ `8 R: Y9 Q2 |ciscoasa(config)#

L2L和REMOTE VPN共用一个策略就可以。