you have a static route pointing to the concentrator, but does your concentrator have the route to get back to the subnets

the inside interface of your pix, i'm assuming is connected to a router. you'll need to put have a route for your vpn subnets pointing to the inside int of your concentrator.

you'll need to nat the pc behind the firewall to a public ip addr. apply your access list to the outside interface.

Two useful command in t/s pix issues:- To see if this is caused by nat. use "debug icmp trace". this will show if your natting as expected- if you're using ver 6.2 or above use the capture command. http://www.cisco.com/univercd/cc/td/doc/product/ia...

at your branch offices, are you terminating the ipsec lan-lan tunnel on a firewall or a the router? for your vpn connection, you could use gre over ipsec to pass your routing protocol. your dll is always up, so you could also enable routing on that...