Core issue
Although sysopt connection permit-ipsec is in the configuration, traffic does not seem to flow between the site-to-site VPN unless the traffic between the subnet in the access list bound with the inside interface is allowed. If there is no access list on the inside interface it works fine. The sysopt command only bypasses the checking of the outside access list.
Resolution
Traffic won't flow through the VPN unless it is permitted in the inside interface access list even if sysopt connection permit-ipsec is configured
Allow the tunnel traffic in the access list bound with the inside interface or remove the access-group access-list in interface inside command.
For additional information on how sysopt works with different versions of PIX Firewall code, refer to the relevant documentation for your PIX release:
Problem Type
Connectivity through the device
Troubleshoot software feature
Product Family
VPN - 3000 series concentrator
Firewall - PIX 500 series
