Hello,
NAT including PAT is used in many networks where IPsec is also used, but there are a number of incompatibilities that prevent IPsec packets from successfully traversing NAT devices. NAT traversal enables ESP packets to pass through one or more NAT devices.
The "sysopt connection permit-vpn" command allows incomming VPN traffic to bypass any ACL on the outside interface. This is done so that you dont have to add any ACL to allow VPN traffic.
If you would like to know more, go to the Cisco ASA Command Reference.
