Windows 2000-based client computers, located behind a NAT device, that have
update 818043 installed can connect to a “public” (not NAT-ed) L2TP/IPSec ××× server.
Windows XP Service Pack 2-based computers, located behind a NAT device, by
default can connect to a “public” (not NAT-ed) ××× server. Computers that run
Microsoft Windows XP Service Pack 2 SP2 cannot connect by default to a L2TP/IPSec
××× server located behind a NAT device. If the ISA 2006 Firewall is located behind
a NAT device and also the Windows XP SP2-based client computer is behind a NAT
device, you must set the AssumeUDPEncapsulationContextOnSendRule registry
value to 2. Check this support link: http://support.microsoft.com/kb/818043. In case
of Windows Vista, when the ISA 2006 fi rewall is located behind a NAT device you
must also edit the registry on the Vista-based computer. Check this support link:
http://support.microsoft.com/kb/926179.
ISA 2006 on Windows 2003 R2 SP2, supports multiple L2TP/IPSec ××× clients
located behind the same NAT device. If Windows 2003 SP2 is not installed, then no
more then one or two clients can successfully connect. Also the NAT device must not
break the NAT-T process (cheap NAT devices might do so)
简短的翻译一下：
1，位于nat后面的windows2000以及win xp sp1的操作系统要想连接到l2tp ***服务器（没有nat）就得安装更新包818043。
2，默认的情况下windows xp2的客户端是不能连接到位于nat后面的l2tp ***服务器。
3，如果在nat后面的windows xp sp2要想连接到位于nat设备后面的isa2006，那么就必须设置isa2006的注册表。
4，如果isa2006的载体是windows 2003 sp2，那么可以支持多个位于nat后面的客户端连接，但是如果载体是2003sp1，的话，那么最多支持两个客户端能够连接成功。
翻译可能有些出入请指正，上面的实验我没有做过无法证明准确性，仅仅是理论