You will want a 7200 at the HQ to support not only the DS3 but also the amount of traffic you plan for the VPNs. The remote offices can use a 1750 router. All of the software configs can be obtained from the examples on CCO.
You will also want to check your routing to the address pool you are using for the VPN clients. Make sure all of your inside networks knows the route back to the clients.
If you are setting up a VPN for mobile clients I would really recommend the VPN concentrators, the clients are much easier to manage this way.If you still do not want the VPN concentrator then use the PIX to terminate the VPNs but both will work.
The PIX will authenticate based on a combination of source and destination IP addresses and port numbers. This means every session will be authenticated
