I have a client with a CSS 11151 content switch. In front of the CSS (the "outside" interface), the client has a PIX and a 3060 VPN concentrator. Some of the traffic comes in from the 3060 and some from the PIX, hence the reply traffic needs to go ...