In order to have the VPN tunnel be initiated only from one end, configure the one end of the connection as originate-only with the originate-only keyword in the crypto map entry, and the remote end with answer-only keyword. Add the line crypto map outside_map 20 set connection-type originate-only and crypto map vpn_map 20 set connection-type answer-only respectively. Refer URL http://www.cisco.com/en/US/customer/docs/security/asa/asa72/command/reference/c5_72.html#wp2069381