could you place a sniffer trace between the CSS and the CE.
Then capture the connection to the site that has problem.
Once you have the sniffer trace, just let me know and I will help you understand what is wrong if necessary.
Could you also send me some data regarding your configs.
Like 'sho run' from the CSS and 'sho tech' from the CE.
My email address is gdufour@cisco.com.
Regards,
Gilles.