I did discover that in order to get the Cisco VPN client to be allowed through an ISA server firewall, you need to create a protocol rule for it (that much I knew). However, if the client address set is restricted, it does not work! It needs to be allowed for Any request. I'd love to know why.