I'm wondering if ext-ACL-IN should also allow esp traffic.

I have put in a statement permit esp in. Here is the output of show ip access-list ext-ACL-IN:

Extended IP access list ext-ACL-IN

5 permit ip 192.168.201.0 0.0.0.255 192.168.1.0 0.0.0.255

10 deny tcp any any log fragments

20 deny udp any any log fragments

30 deny icmp any any log fragments

40 deny ip any any log fragments

50 deny ip any any option any-options

60 deny ip any any ttl lt 3

70 deny ip host 0.0.0.0 any

80 deny ip 127.0.0.0 0.255.255.255 any

90 deny ip 192.0.2.0 0.0.0.255 any

100 deny ip 224.0.0.0 31.255.255.255 any

110 deny ip 10.0.0.0 0.255.255.255 any

120 deny ip 172.16.0.0 0.15.255.255 any

130 deny ip 192.168.0.0 0.0.255.255 any

140 permit udp any eq domain any (3330 matches)

150 permit udp any eq ntp any (1700 matches)

160 permit udp any any eq isakmp (774 matches)

170 permit udp any any eq non500-isakmp (347 matches)

180 permit esp any any

190 permit icmp any any time-exceeded

200 permit icmp any any unreachable (159 matches)

210 permit icmp any any echo-reply

220 permit tcp any any established (87522 matches)

230 deny ip any any (1471 matches)

Also, attached is an output of the VPN client's route table: before and then after a connection is established.

Can you verify that the devices on your internal network have a route to the address pool used by the VPN client?

I can confirm that this is the case. In fact, the router with the VPN Client config is the LAN default gateway as well.