---- The first one -- interface Vlan1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 10.10.10.1 255.255.255.0 ! interface Vlan3 nameif dmz-office security-level 50 ip address 172.16.3.1 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 switchport access vlan 3 ! interface Ethernet0/6 ! interface Ethernet0/7 ! protocol-object udp protocol-object tcp access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 static (outside,inside) tcp 192.168.10.35 www 192.168.10.35 www netmask 255.255.255.255 static (dmz-office,inside) 172.16.3.14 192.168.10.35 netmask 255.255.255.255 static (inside,dmz-office) 172.16.3.0 172.16.3.0 netmask 255.255.255.0 crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs crypto map outside_map 1 set peer 10.10.10.2 crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 no crypto isakmp nat-traversal crypto isakmp am-disable tunnel-group 10.10.10.2 type ipsec-l2l tunnel-group 10.10.10.2 ipsec-attributes pre-shared-key * ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 -- The other one: --- interface Vlan1 nameif inside security-level 100 ip address 192.168.100.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 10.10.10.2 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! access-list mideye_splitTunnelAcl_1 standard permit 192.168.100.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip host 192.168.100.0 host 192.168.1.0 access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list test_splitTunnelAcl standard permit 172.16.1.0 255.255.255.0 access-list mideye_splitTunnelAcl standard permit 172.16.1.0 255.255.255.0 access-list outside_1_cryptomap extended permit ip host 192.168.100.0 host 192.168.1.0 access-list outside_1_cryptomap_1 extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0 255.255.255.0 pager lines 24 logging enable logging asdm debugging logging class auth asdm debugging mtu inside 1500 mtu outside 1500 ip local pool vpnPool 192.168.200.1-192.168.200.254 mask 255.255.255.0 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 crypto ipsec transform-set FirstSet esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto dynamic-map outside_dyn_map 20 set pfs crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs crypto map outside_map 1 set peer 10.10.10.1 crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map0 1 match address outside_1_cryptomap_1 crypto map outside_map0 1 set pfs crypto map outside_map0 1 set peer 10.10.10.1 crypto map outside_map0 1 set transform-set ESP-3DES-SHA crypto map outside_map0 interface outside crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 43200 crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value mideye_splitTunnelAcl_1 default-domain value * tunnel-group 10.10.10.1 type ipsec-l2l tunnel-group 10.10.10.1 ipsec-attributes pre-shared-key *