This should be do-able - just set up a normal site to site VPN tunnel for the one that is reachable via a static IP address, and for the internet one use a dynamic crypto map entry as the last entry if the public IP address is going to change, like the configuration below: ASA-to-ASA Dynamic-to-Static IKEv1/IPsec Configuration Example - Cisco I'm assuming that you're doing this on the same interface, not 2 different ones. If it's 2 different interfaces then you'll have 2 different crypto maps (1 assigned to each interface), and if the public IP address for the peer changes, then use the dynamic crypto map option on the interface facing the internet.
... View more
