normally all outbound access should be sourced from the primary IP address assigned to the ISA external interface. However, I've seen some reports that now and then a secondary IP address is used. So, I assume this is some nasty bug.
As far as I know this is still an open issue although I was told that you could disable IP Routing in the IP packet filter properties to mitigate the problem. Note that disabling IP routing also disable the kernel data pump.
I have a question regarding the opposite of the above issue. Is there a way to force ordinary outbound web traffic, for example, out one of many bound IP addresses on the external interface other than the default machine IP? I have ISA 04 running for publishing and inbound VPN, but now that those services have been established, we are migrating off the older ISA's and I need to add outbound web access. I would rather not mix the services on one address since it will make life easier the next time I need to migrate. I would also rather not have to contact all external users and make them alter the way they contact the server. Forcing web traffic, or even SMTP outbound, on a particular IP would be my preference. Is there a slick way, or would I be better off changing the machine IP?