What VPN devices are you using? It's relatively normal for a device to respond to a TCP connection request with a RST, so any true firewall should forward it unless there's some other anomaly with the packet (such as an invalid combination of options or other things the firewall might consider a "problem"). If you're using PIX's, I'd check your logs, since the PIX is pretty good about logging stuff it doesn't like (you have to enable logging at the "warnings" level to see most of these messages).
Are your crypto access-lists at both ends mirror images of each other (i.e. the sources and destinations are identical but reversed)? If not, that can easily cause return traffic to fail.
Also, a router with simple access-lists instead of CBAC may will be dropping the reply, so check your access-lists if that's what you're using.
Finally, it could also be something as simple as a routing problem. Does the server at Site 2 have a valid route back to Site 1 pointing at the VPN termination device at Site 2? It's easy to forget about return routes, especially if the VPN devices aren't also the devices that provide Internet connectivity for the site.
HTH - Good luck!
Dana
