The following has worked on my 1710 in the office. It works with site-to-site tunnels to other Cisco IOS VPN routers but I haven't tried it with VPN Client Software. It has also worked installed at some of my customer's sites:
access-list 123 permit icmp any host unreachable
access-list 123 permit icmp any host echo-reply
access-list 123 permit icmp any host packet-too-big
access-list 123 permit icmp any host time-exceeded
access-list 123 permit icmp any host traceroute
access-list 123 permit icmp any host administratively-prohibited
access-list 123 permit icmp any host echo
access-list 123 permit tcp any host eq telnet
access-list 123 permit udp any host eq isakmp
access-list 123 permit esp any host
access-list 123 permit ahp any host
access-list 123 permit icmp 192.168.0.0 0.0.255.255 192.168.1.0 0.0.0.255
access-list 123 permit icmp 192.168.0.0 0.0.255.255 192.168.7.0 0.0.0.255
access-list 123 permit udp any host eq ntp
!
!
ip inspect audit-trail
ip inspect name fw ftp timeout 3600
ip inspect name fw smtp timeout 3600
ip inspect name fw tcp timeout 3600
ip inspect name fw tftp timeout 30
ip inspect name fw udp timeout 15
!
!
interface Ethernet0
ip address 255.255.255.248
ip access-group 123 in
ip nat outside
half-duplex
crypto map
!
interface FastEthernet0
ip address 192.168.7.1 255.255.255.0
ip access-group 121 in
ip nat inside
ip inspect fw in
speed auto
Are you sure that your IPSEC tunnel access-lists are ok and that IPSEC tunnel traffic is excluded from NAT?
Good Luck,
Joe Beckner
