Which configuration allows a Cisco ASA to receive an IPsec connection from a peer with an unknown IP address?

A dynamic crypto map is a special crypto map entry without a set peer statement, allowing the ASA to accept IKE negotiations from any IP address that matches the configured transform-set and ACL parameters. It is inserted at the end of the static crypto map sequence so static peer entries are checked first, and the dynamic entry catches all remaining unknown-IP peers. This is the standard ASA mechanism for supporting road-warrior or dynamically addressed site-to-site VPN peers.

Tunnel groups on the ASA are identified by IP address or group name; there is no 'dynamic tunnel group' feature for accepting unknown-IP IPsec peers.

Dynamic AAA attributes control authorization attribute delivery after authentication and have no role in accepting IPsec connections from unknown IP addresses.

Dynamic Access Policy (DAP) applies posture-based access control to AnyConnect SSL/TLS sessions and is unrelated to site-to-site IPsec peer address resolution.