on the router this makes the identifier the dn
crypto isakmp identity dn
On the ASA
tunnel-group 200.0.23.3 type ipsec-l2l
tunnel-group 200.0.23.3 ipsec-attributes
pre-shared-key cisco
trust-point ROUTER2
peer-id-validate nocheck
trust point needs to be set two different places.
tunnel-group for receiving
tunnel-group 200.0.23.3 type ipsec-l2l
tunnel-group 200.0.23.3 ipsec-attributes
pre-shared-key cisco
trust-point ROUTER2
crypto map for initiating it.
crypto map CRYPTO 10 set trustpoint ROUTER2