How do I allow VPN connections to my ISA server?

I have ISA 2006 on Win2k3 on which I believe I’ve configured the VPN settings. This server sits behind a Netscreen firewall and I’d like to know what I have to do on the firewall, e.g. ports to allow so VPN users can connect to ISA and subsequently the internal network. I should also mention the topology is Internet > Netscreen > DMZ > ISA 2006 > Internal network.

Any helpful how-tos or resources on this topology would be much appreciated, as you might have guessed I’m new to ISA.