I have thought through the concept of 'passing packets out the same interface that they came in on the PIX', but I am fairly certain this is not the issue either. Rather, this is the reason WHY I have to come up with the SSH tunneling workaround. If the Cisco PIX could pass packets back out the same interface then we wouldn't have this challenge, I think.