On our recent PIX501 install, we use IpSec clients to reach the outside public IP of the PIX. The tunnel then allows connection to any of the static, non-public IP's running PcAnywhere hosts. Our consultant doesn't care for open ports, so we are lo...