You must enable NAT traversal on the VPN server first, using say port 10000. Then, on ISA Server, create two protocol definitions - UDP port 10000 (send/receive) and UDP port 500 (send/receive). Then use SecureNAT on the Nortel client.