说明：
host-name 指定IPSec peer的DNS主机名称，如：myhost.example.com。
dynamic (可选参数) 指定 IPSec peer 的主机名在需要建立IPSec通道的时候才通过DNS服务器解释为IP地址。
ip-address 直接给出IPSec peer的IP地址（传统的配置方式）。

实际环境中局域网内应在一台机器上运行动态域名解释客户端程序，以将主机名nbo.3322.org注册到服务器，注册地址是路由器的外网端口地址。

version 12.3
!
hostname vpn-2
!
username mize password 0 http://mize.netbuddy.org
no aaa new-model
ip subnet-zero
!
ip cef
ip name-server 202.96.134.133
!
crypto isakmp policy 1
authentication pre-share
group 2
crypto isakmp key cisco hostname nbo.3322.org
!
crypto ipsec transform-set s2s esp-des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer nbo.3322.org dynamic
set transform-set s2s
match address 110
!
interface FastEthernet0/0
ip address 202.11.22.43 255.255.255.248
ip nat outside
crypto map mymap
!
interface FastEthernet0/1
ip address 172.30.1.1 255.255.255.0
ip nat inside
!
ip nat inside source route-map nonat interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
!
access-list 110 permit ip 172.30.1.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 120 deny ip 172.30.1.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 120 permit ip 172.30.1.0 0.0.0.255 any
route-map nonat permit 10
match ip address 120
!
end