PIX to PIX VPN with PATing PIX in between

Hi,

I used to have a PIX to PIX VPN tunnel - When I set it up, it was quite straight forward with both PIXs having public Internet IPs.

Due to a change at one site (they've run out of external IPs) I have to move my PIX behind their PIX which provides PAT for the hosts behind it.

I enabled nat-translation on both of my PIXs and moved my PIX behind theirs. They've given my PIX on their network unrestricted access to my (still) Internet exposed PIX - however, my tunnel will not come up.

To summarise, the network is now my PIX with 172.16.20.x on its internal interface and 10.10.10.10 on its external. It sits behind their PIX with 10.10.10.1 on its internal and THEIR-PIX-WITH-INTERNET-ADDRESS on it’s outside. And the tunnel from my PIX on their network is supposed to terminate on my PIX (as it used to) with external address MY-PIX-INTERNET-ADDRESS.

The debug on the Internet exposed PIX shows:

ISAKMP (0): Checking ISAKMP transform 1 against priority 10 policy
ISAKMP:      encryption DES-CBC
ISAKMP:      hash MD5
ISAKMP:      default group 1
ISAKMP:      auth pre-share
ISAKMP:      life type in seconds
ISAKMP:      life duration (basic) of 1000
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): processing vendor id payload

ISAKMP (0:0): vendor ID is NAT-T
ISAKMP (0): processing vendor id payload

ISAKMP (0:0): vendor ID is NAT-T
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
ISAKMP (0:0): sending NAT-T vendor ID - rev 2 & 3
ISAKMP (0:0): Detected port floating
return status is IKMP_NO_ERROR

Which, until this points looks pretty good...

crypto_isakmp_process_block:src:<THEIR-PIX-WITH-INTERNET-ADDRESS>, dest:<MY-PIX-INTERNET-ADDRESS> spt:1 dpt:500
VPN Peer:ISAKMP: Peer Info for <THEIR-PIX-WITH-INTERNET-ADDRESS>/500 not found - peers:0

Which is where it appears to fall down. At the same time, my PIX behind theirs shows:

ISAKMP (0:0): sending NAT-T vendor ID - rev 2 & 3
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block:src:<MY-PIX-WITH-INTERNET-ADDRESS>, dest:10.10.10.10 spt:500 dpt:500
ISAKMP: sa not found for ike msg

(10.10.10.10 is the external address of my PIX behind theirs, it serves 172.16.20.x on its internal)

I'm confused by the two PIXs not using the same ports. In fact, I'm confused why it's not working in general, any thoughts?