I thought hubs were layer 1 devices, and so would have no active role in IPSec. I am reading to understand crypto maps,
Dynamic crypto map policies are used in site-to-site VPNs when an unknown remote peer tries to initiate an IPsec security association with the local hub. The hub cannot be the initiator of the security association negotiation. Dynamic crypto policies allow remote peers to exchange IPsec traffic with a local hub even if the hub does not know the remote peer's identity.
and apparently a hub may know the identity of a peer. If a hub is layer 1 only, how is this possible?