nat and global are only for connections that originate inbound and are destined for outside hosts. When you want to start a connection from an outside host to inside host you need to use statics, as well as explicitly allowing the traffic in the acl applied to the outside interface. One note about vpn traffic - if the sysopt permit-ipsec is turned on, then you do not need to add the acl entry on the outside interface, but you still need the static.
So remove the nat (DMZ) 0 statement, and run the clear xlate local 172.17.0.17 and the clear xlate local 172.17.0.18 commands
If you are using pix 6.3.3 code you can do this:
1. Remove the MDC_Connect1 acl and replace it with these 2 acls:
access-list MDC_Connect1 permit ip host 172.17.0.17 host 192.168.0.5
access-list MDC_Connect2 permit ip host 172.17.0.18 host 192.168.0.5
2. Enter these statics:
static (dmz,outside) 172.17.0.17 access-list MDC_Connect1
static (dmz,outside) 172.17.0.18 access-list MDC_Connect2
Let me know if you are running a 6.3 code lower than 6.3.3, or if this helps.
