pbx2 and www2 are 1-to-1 natted (all packets on two different public ips go to 192.168.2.22 and 192.168.2.24, respectively). 

       internal ip      external ip (1to1 nat)
pbx2     works           works
www2     works           broken

Ifconfig on pbx2:
========================= pbx2 network info
root@pbx2:~# ifconfig
(local loopback exists to, removed for brevity)
eth0      Link encap:Ethernet  HWaddr 00:16:3E:72:87:1D  
          inet addr:192.168.0.22  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe72:871d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:246665 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10058 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:28917471 (27.5 MB)  TX bytes:1499032 (1.4 MB)

eth1      Link encap:Ethernet  HWaddr 00:16:3E:72:27:AD  
          inet addr:192.168.2.22  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe72:27ad/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:48766 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21781 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:11188027 (10.6 MB)  TX bytes:3457068 (3.2 MB)

root@pbx2:~# ping 192.168.0.1
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=2.36 ms

root@pbx2:~# ping 192.168.2.1
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.541 ms

========================= www2 network info
root@www2:~# ifconfig
(local loopback exists to, removed for brevity)
eth0      Link encap:Ethernet  HWaddr 00:16:3E:16:D4:44  
          inet addr:192.168.0.24  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe16:d444/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3382 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1288 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:327915 (320.2 KB)  TX bytes:937026 (915.0 KB)

eth1      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          inet addr:192.168.2.24  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::200:ff:fe00:0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:31 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

root@www2:~# ping 192.168.0.1 -c 1
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=4.23 ms

root@www2:~# ping 192.168.2.1 -c 1
From 192.168.2.24 icmp_seq=1 Destination Host Unreachable


============================ pbx2 (eth1 and eth2 work fine) =================
kernel      = '/boot/vmlinuz-2.6.22-14-xen'
ramdisk     = '/boot/initrd.img-2.6.22-14-xen'
memory      = '4096'
extra       = 'xencons=tty'
vcpus       = 4
root        = '/dev/sda1 ro'
disk        = [ 'phy:talon/pbx2-disk,sda1,w',
                'phy:talon/pbx2-swap,sda2,w',
                'phy:talon/pbx2-spool,sda3,w' ]

name        = 'pbx2'
vif         = [ 'ip=192.168.0.22,mac=00:16:3E:72:87:1D,bridge=xenbr0',
                'ip=192.168.2.22,mac=00:16:3E:72:27:AD,bridge=xenbr1' ]

on_poweroff = 'destroy'
on_reboot   = 'restart'
on_crash    = 'restart'

========================== www2 (eth1, 192.168.2.24 broken) ==================
kernel      = '/boot/vmlinuz-2.6.22-14-xen'
ramdisk     = '/boot/initrd.img-2.6.22-14-xen'
memory      = '512'
extra       = 'xencons=tty'
vcpus       = 4

root        = '/dev/sda1 ro'
disk        = [ 'phy:talon/www2-disk,sda1,w', 'phy:talon/www2-swap,sda2,w' ]
name        = 'www2'

vif         = [ 'ip=192.168.0.24,mac=00:16:3E:16:D4:44,bridge=xenbr0',
                'ip=192.168.2.24,mac=00:16:3E:16:G4:24,bridge=xenbr1']

on_poweroff = 'destroy'
on_reboot   = 'restart'
on_crash    = 'restart'