F.1
The first, we need setupConfigure IP Address at lab machines as figure 1
Join server ISA-msviet to DCmsviet (msviet.com)
Join server ISA-vispro to Dcvispro (vispro.com)
Step 2:
At ISA-msviet create new user: vispro / password
At ISA-vispro create new user: msviet / password
At the moment, confer these user have allow access in Dial-in Tab
Step 3:
Install Isa 2006 standar to ISA-msviet and ISA-vispro
Configure ISA rule, the following figure:
F.2
The IP range: 100.100.100.1 – 100.100.100.254 (customize) is virtual range IP which assigned automatic for clientvpn access to Internal (192.168.10.0/24)
To continue, select Remote sites Tab: create new connection
F.3
Note: site name = username which create at last step, here( ISA-mviet) sitename= vispro
Select Point-to-Point at next table.
In table Remote Site Gateways, enter the IP Address of Remote site VPN server that allow Internal connect out site, here we type 192.168.1.201 – interface WAN in ISA-vispro.
Click next, we to Remote Authentication tab, at that type user remote is created out site (vispro) – msviet / password
The part Network Address, specify IP range Internal on out site, at here we type 192.168.11.1 - 192.168.11.254
To continue, click next and select protocol (all outbound traffic), the end click finish.
Step 4:
Right mouse on Virtual Private Network and select properties, at tab access network we tick EXT, vispro as following figure:
F.4
Ok, we configure successful in ISA-msviet. Analog simulator, we’ll configuration on server ISA-vispro
Step 5: at both ISA server,
Start Routing and Remote access, ensure Network interface is connected
F.5
Note, in ISA2006, we must edit system policy on Firewall Policy ( both isa server)
F.6
Now, we can access resource from site msviet to site vispro.a
From the Start menu, select Settings, select Network and Dial-up Connections, and then click Make New Connection.
For Windows XP, goto Control Panel and select 
From the Network Connection Wizard, click Next. 
From Network Connection Type, click to select Connect to a private network through the Internet, and then click Next.
You may see the Public Network screen at this time. Click to select the dial-up connection that connects you to your ISP. If your physical connection is an Ethernet connection, select Do not dial initial connection. If the physical connection is through an ISP, select Automatically dial this initial connection. Click Next.
From Destination Address, in the Host name or IP address box, enter the IP address or hostname of your Juniper Firewall's Untrust interface, and then click Next.
From Connection Availability, click to select For all users, and then click Next.
From the Completing the Network Connection Wizard, enter a connection name, and then click Finish.
Click Properties. 
Click to select the Security tab, click to select Advanced (custom settings), and then click Settings. 
From Advanced Security Settings, from the Data encryption drop-down menu, click to select Optional encryption (connect even if no encryption). 
From Logon security, click to select Allow these protocols. Click to select only Unencrypted password (PAP) and Challenge Handshake Authentication Protocol (CHAP). Click to clear any protocols that do not apply. 
Click OK.
Click to select the Networking tab. From the Type of VPN server I am calling drop-down menu, click to select Layer-2 Tunneling Protocol (L2TP).
Click OK.
From Network and Dial-up Connections, double-click the Dial-up Connection.
Enter your User name and Password.
Click Connect.
