Ref links;

• ISA 2004 http://www.microsoft.com/technet/is...mspx 
• ISA 2006 http://www.isaserver.org/tutorials/ISA-Server-2006-Flood-Mitigation.html

connection limits will need to be reconfigured to prevent tunnel connections from getting dropped;

symptoms; ISA Server disconnected a non-TCP connection from xxx.xxx.xxx.xxx because the connection limit for this IP address was exceeded. Larger custom connection limits should be configured for the IP addresses of chained proxy servers and back-to-back ISA Server computers with a NAT relationship.