I think you're on the right track.
Now that the Cisco VPN Client comes with firewall functionality, you may want to check that the "Stateful Firewall (Always On)" selection on the VPN client is not checked. To verify (with the tunnel up), right click on the tool tray icon for the Cisco VPN Client, and you will see the fourth line down, Stateful Firewall (Always On). If this is checked, uncheck it, and give it a try.
If this fixes your problem, do some reading on how this "Always On" firewall functions. What I found was that the pushed policy (from the concentrator) functions separately from this "Stateful Firewall". It's almost like they are two different products that function independently.
When this item is checked, all the pushed policies from the concentrator are ignored, and all inbound packets are blocked from any port that isn't involved in a conversation. There is I believe one exception to this rule, DHCP, which is permitted to get through.
For example all web traffic will work, because it's part of the conversation, and is on established ports. On the other hand, X windows and FTP initiate conversations on one port, and data comes back to the client on another port (eg: ftp control and data ports). Post an update when you get the opportunity. I hope this helps... Bruce
