The main difference is that config-2 will use a lifetime for the IKE (Phase 1) SA's, 3des to protect the phase 1 process, and DH Group 2. Most remote peers are likely to use either des or 3des for phase 1, however the most likely reasons for failure if you use config-2 is that the remote peer does not have a lifetime coded (other than the default), and/or it may not use DH groups as part of phase 1, so before you use it, insure that the remote side can use the same DH group and has a lifetime configeured - the lifetime does not have to match yours, but it is better if they match as there may be an issue where the side with the higer timeout will fail to renegotiate when it initates it because the other side has the lower timeout value. Newer code may not have that problem.
I have had to remove the timeout for phase-1 sa's on my VPN gateways, beacause of that issue - which will stop the apps (using phase 2) from working.
With respect to phase 2 (IPSec) sa's, that is the crypto maps, config-1 is using dh group 1 for pfs, while config-2 is not using it. Again both peers will need to use pfs and the same group. PFS basically says not to derive a new key from the existing one.
Let me know if this helps.
