Thank you for your example. But now i have such configu

ration. My problem is to add new dynamic tunnel to existing configuration.

There are in the example:

!--- The security appliance provides the default tunnel groups
!--- for Lan to Lan access (DefaultL2LGroup) and configure the preshared key
!--- (cisco123) to authenticate the remote router. 
Should i use the same preshared key on the new site? Or i had to create new tunnel group?

Oleg Kobelev

When you have configured a dynamic L2L tunnel - you can have only 1 psk.  As it's a default L2L - that is the difference to a specific PEER config.

So I would suggest you choose a long & complex PSK as you have to use it for ALL dynamic L2L VPN's.

HTH>

So, i have to add only access

-list entery for new network? No new crypto map and isakmp policy?

Oleg Kobelev