Can a PIX use a AAA server that is on the other side of its own IPSec tunnel?

In theory, Yes. I believe I've seen a cisco configuration example for that case (but I'm not sure I could find it now.)

Here is a Cisco example of paaing SNMP and syslog over a PIX VPN tunnel.

See no reason why AAA could not use similiar setup.

Monitoring Cisco Secure PIX Firewall Using SNMP and Syslog Through VPN Tunnel

Thanks for the replies. So far I have been unable to make it work. It works if I let the traffic go unencrypted between the remote PIX and the AAA server but as soon as the I add the respective source and destination IPs in my access list to be protected by the crypto map it quits working.

Will have to do some sniffing and troubleshooting to see what I'm doing wrong.

Thanks,

Shahid

Have you tried with: management-access inside ? Bye, Max.

try using the capture command on the PIX closest to the AAA server to capture the AAA packets.

You can set up and access list to go along with the capture command so that the capture can be restricted to just the AAA packets