Complex VPN setup on PIX515

If I recall correctly, PIX up to and including 6.1 will syntactically accept port specifications in crypto map access lists, but will grumble about them and ignore them. I believe it was PIX 6.2 that enabled port specifications for this purpose.

Keep in mind that ftp needs a control connection (port 20) and arbitrary ports (1024 upwards) according to the FTP PORT command; the direction that the FTP connections are opened in depend on whether you are using PASV or not, and depend upon which side the data is coming from. As you are controlling the access so narrowly by port number, the dynamically allocated port numbers will not match your apply_to_crypto ACL and so data on them would not be tunneled through the VPN.

cf. the above discussion of the dynamic ftp ports. If the dynamic ports

It is not an outright error to have a nat 0 access-list which is a superset of your crypto map access-list, but you need to consider what you want to happen to the packets that fall inbetween. If you want those packets blocked, then you are likely better off NOT using "sysopt connection permit-ipsec" and instead place appropriate restrictions on the interface acls (access-group ... in interface inside) and then have the crypto map be the more general version; if you configure things that way, then when the PIX adaptive security makes pinholes for ports that would otherwise be denied, the port traffic will travel over the VPN if everything else is right.