If you're running <= v6.2 then a tunnel from the PIX outside interface to the inside network should automatically be created, allowing you to simply add a url-server in with the remote server address.
In 6.3 this changed and the PIX would not automatically create this management tunnel. Add the following to the 501 and it should create the management tunnel:
vpnclient management tunnel
This should then tell the 501 to create a tunnel from its outside interface to the 515 inside subnet, again allowing you to use the url-server remotely.
You can do a "sho cry ipsec sa" to see what subnets/tunnels it has created.