Apparantly you can't get the Symantec VPN client through an ISA firewall. The IPSec encapsulation is not standard.