Check your AAA statements on your pix.
For example:
aaa authentication exclude ftp inside 10.1.1.2 255.255.255.255 0.0.0.0 0.0.0.0 TACACS+
PIX will not prompt user 10.1.1.2 for authen.
You may also need to add this if your dial-up is not inside:
aaa authentication include ftp inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 TACACS+
NAT has nothing to with this.
Michael P.