We have a cisco pix 515E 7.0(1) and a 2801 IOS 12.4(11)T (fc2). They're both configured as Easy VPN Servers with IPsec over TCP on.
Cisco VPN clients will successfully initiate and establish IPsec-over-TCP sessions with both of them.
The problem is with routers running IOS 12.4(11)T Advanced Security configured as Easy VPN clients. We can't get those to initiate an IPsec over TCP session.
The URL below does have a clear example on how to do this, but we don't have the "ctcp enable" available.