You can do a NAT to anything before going through the VPN on the PIX. However, there's a catch: If that NATed IP address is a 10.x address as your diagram suggests, the NATed host (server I) would not be able to access the Internet because to the outside world, it would appear to have a 10.x address.
Luckily, there is more than one way to do this. Here's how I would do it:
1) On the PIX end, specify NAT 0 for Server I when it's going through the VPN to 10.x addresses. The address will come through the tunnel "appearing" as 192.168.110.8. Here's what the commands would look like:
access-list nonat permit ip host 192.168.110.8 host 10.128.205.77
nat 0 access-list nonat
What this is basically saying is "Use NAT for everything EXCEPT when host 192.168.110.8 needs to talk to 10.128.205.77. If that's the case, don't NAT the address."
2) Since your VPn concentrator is ver. 3.6.7, you can do NATs on inbound traffic. Set the concentrator to NAT this 192.168.110.68 address to a 10.x.x.x address.
Here's the Cisco doc that explains how to do that part:
There are other ways to do it. Also look into using the PIX EzVPN feature to make the PIX like a hardware client to the concentrator. I just happen to like the way I mentioned above a little better.
