Disclaimer The opinions expressed herein are my own personal opinions and do not represent my employer's view in anyway.
ISA 2004 has VPN quarantining. This is the ability to check a VPN clients patch level, and antivirus version before it is allowed onto the network. If it doesn't meet the requirements the client is moved to a safe area (quarantined) while said patches and AV updates are installed. I think it's actually a function of Windows, but massively updated in ISA 2004.
whitepaper for further perusal