I thought about this last night. The denied error is to IP1. Are you telling the VPN client to connect to the outside interface of the ASA or are you trying to connect the VPN to IP1? When you run the wizard, it will setup the VPN to allow it to connect to the interface you specify in the wizard. In this case I would guess that you would want to use the outside interface. Your VPN client should then use that host address (Outside interface) to connect to. That deny almost looks like you are trying to connect to IP1.
... View more