dialin users cant get to Web thru ISA

After implementing authentication for outbound web requests in ISA, dialin users can no longer get out to the web, though they can get to local resources. It appears that authentication information is being stripped by dialin before getting to ISA, so they are not authenticated, and thus denied access. Clients and servers are W2K. How can I keep authentication on but allow dialin users to access the web?