I believe the reference is to the client being behind a PIX not necessarily the concentrator.
Also, when I've run into these issues I try to use TCP over IPSec. If that’s a problem try using IPSec over UDP and if that still isn't working you can always try it without transparent tunneling.
On occasion I will see users who get dropped over a dialup connection as well. The dialup stays connected, but the tunnel drops. In those instances its usually been a problem with latency that clears up later on or the next day. You can mess with the peer timeout value within the dialer and/or the forcekeepalives=1 option within the .pcf file.
Also consider this:
When using the VPN Client behind an ESP-aware NAT/Firewall, the port on the NAT/Firewall device may be closed due to the VPN Client's keepalive implementation, called DPD (Dead Peer Detection). When a client is idle, it does not send a keepalive until it sends data and gets no response.
To allow the VPN Client to work through ESP-aware NAT/Firewalls, add the ForceKeepAlives parameter to the *.pcf (profile configuration file) for the affected connection profile. This parameter enables IKE and ESP keepalives for the connection at approximately 20 second intervals.
Use the following syntax when adding this parameter to the [Main] section of any *.pcf file:
ForceKeepAlives=1
For more information, see "Connection Profile Configuration Parameters" in the VPN Client Administrator Guide.
Hope this helps..
