I've got several sites with IPSEC tunnels built between PIX firewalls to encrypt/sign the traffic moving between the "inside" networks on those firewalls. These sites use identity nat where every inside address is directly natted to the same address...