Mike,

The tunnel-groups are used to be able to tell the ASA what type of remote access to allow the peer to use. You can have remote access or l2l tunnel-groups. The l2l tunnel group references the ip address of the remote peer, and under this it would have the pre-shared key that has to match on both ends.

The tunnel-group is associated to your crypto map. The l2l tunnel group that has the pre-shared key is for phase 1 negotiations, and phase 2 is done through your transform-sets and ACLs that are applied to your crypto map:

crypto map VPN 10 set peer 5.5.5.5

crypto map VPN 10 match address VPN

crypto map VPN 10 set transform-set VPN

tunnel-group 5.5.5.5 ipsec-l2l

tunnel-group 5.5.5.5 ipsec-attributes

pre-shared-key test

access-list VPN permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

When a request comes in from 5.5.5.5 for 192.168.1.0, then the crypto map that's applied to the outside interface runs through it's sequence numbers to find a match. After it sees 5.5.5.5 as the requesting peer, it tries to match up the key with the tunnel-group. If that matches, then it proceeds to the next steps making sure that the same traffic is encrypted on the other side, transform sets match, etc.

The default-group-policy is a "catch-all" that matches anything that doesn't match the "vpn-group-policy" that you have. If you have a user using "vpn-group-policy", but you have other users that aren't locked into a group, then they'd use the default group policy.

HTH,

John