On ISA Server? I just opened a tkt w/ Microsoft because we're trying to get ISA's server publishing rules to work w/ IPO in allowing an IP phone to register w/ the system behind a firewall.
ISA can NOT do this currently. That was on v2003. I don't know about v2004 coming out, but so far, ISA was unable to support VoIP Telephony in this manner. I suspect your issue lies directly w/ the ISA server. Basically, what Microsoft said, was that the ISA server can't know what dynamic ports need to be opened. And since you can't publish an entire range of ports w/o a serious amount of work, it basically can't be done.
Granted, your VPNing into the system, but I still think the issue is ISA's inability to support that.
Hope this helps...
Kris