have you actually looked at the output of an sniffer outside and inside a netowrk protected by a pix and see a cisco remote connection appeared ? check it out ....