I was able to narrow down my problem to RRAS. When I start it up, no one has access to the internet (most are using secure-nat). The only way I could get them back on was to stop RRAS & reboot the ISA Server.
I had one client using the Firewall client software and while RRAS was on, it still was not able to reach the internet. However the GW address still pointed to the Internal NIC of the ISA Server. Does that matter?
On the web browser of the clients get a 'connection timeout' when trying to reach a web site while RRAS is up.
Im a little lost on your last message. I was messing around with it today, and when I start RRAS now the client can reach the internet for about 4-5 minutes then it disconnects them (I can't even ping from the ISA server). Then a few minutes later everything comes back to normal.
This is a cycle, 4-5 mins with internet, then another 4-5 without, etc..
Somehow its timing out? I have some screen shots and did a route print if you would like to look at it.