Checkpoint VPN-1 SecureClient Behing MS ISA 2000/2006

I have a Microsoft ISA 2000 server for proxy and firewall use for the office.
A business requirement was to install the Checkpoint VPN-1 SecureClient (http://www.checkpoint.com/techsupport/downloads/bin/securemote/r60/hfa02/SC_NGX_R60_HFA2_630000044.msi) on a user’s machine running Microsoft Windows XP SP2.

Unfortunately the Checkpoint VPN-1 SecureClient will only pass through the ISA 2000 when selecting ‘Visitor mode’ (HTTPS).

ISA 2000 (and later ISA 2006) will block any attempt for ‘NAT traversal tunneling’ using ‘IKE over TCP’ or ‘UDP encapsulation’.

Is it possible to have this combination ‘Checkpoint client behind MS ISA’ to have a point-to-point VPN through ISA?

If yes, is there any reference on how to configure the MS ISA 2006?