How are the guest offices going to connect to your ftp server? Thru a vpn connection to one of your vpn gateways (such as the pix)? You mentioned no issues with connectivity, so I assume that the ftp server is accessable thru the pix, but is that only true for inside devices and not outside ones?
If someone is going to connect to that ftp server via the outside interface then you need to use a static statement to allow that host to be addressable, and you will need to create an access-list and apply it to the outside interface like this:
static (dmz, outside) e.e.e.e i.i.i.i netmask 255.255.255.255, where e.e.e.e is the address of the ftp server as seen by outside hosts, and i.i.i.i is the true ip address
access-list acl_out01 permit tcp any gt 1023 host e.e.e.e eq 21 - note that only the connection to the ftp control port is needed as the pix will add dyanmic entries as it sees the ftp port command flows.
Some helpful URL to aid you in configuring and troubleshooting:
http://www.cisco.com/en/US/products/sw/secursw/ps2120/tsd_products_support_series_home.html - the home page for pix fw software tech support and doc
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_installation_and_configuration_guides_list.html - pix config guide for a variety of sw release levels
Let me know if this of any help.
