How about the Nexus 5672? At least found no reference to MacSec in the docs, only TrustSec.

I just read in this forum that the 'Allow Local LAN access'-parameter doesn't have any effect with the PIX so you'll have to forget about that option.You need to use split-tunneling, include all ranges used in the main office which should be accessib...

You may be missing static mappings between the interfaces?

Maybe you used different vpngroups for the both types of clients with different VPN-pools? And maybe one of these ranges is not routed internally?