It is possible to configure a L2L session on a VPN3k using CLI only.  It is a completley different configuration.  Here is the summation of it:

1. Create an SA
2. Create inbound and Outbound rules for the hosts to be encrypted.
3. Apply the rules to the public filter with the action of “Apply IPSec” and attach the Security Association.
4. Create a group with the preshared key.
5. Set it to type L2L.

Now it seems like a short list but jumping around in the CLI menus makes it tough.

TIP:


When you are looking at the public filter you want to see the
IPSec Rules applied with the Security Association Attached.

Uploaded with plasq‘s Skitch!