[chillyjim]

This is a configuration problem somewhere. Check the routing on client 1, check the encryption domains of both peers.

From client 1, do a traceroute and see where it thinks the packets are going.
From the gateway you can do an:

fw monitor -e 'accpet (src=192.168.1.1 and dst=10.0.0.1) or \
(src=10.0.0.1 and dst=192.168.1.1) ;'

and see if the packets are going through the firewall.