KB 957624 - A Windows Vista-based or Windows Server 2008-based computer behind a NAT device cannot communicate with another computer through an IPsec tunnel-mode connection

This might improve behavior of the Cisco VPN client under Vista/Server 2008. It is too bad they are not providing a 64-bit client for their IPSec VPN.

SYMPTOMS
You use a Windows Vista-based or Windows Server 2008-based computer that is behind a Network Address Translation (NAT) device. When you use this computer to try to communicate with another computer through an Internet Protocol security (IPsec) tunnel-mode connection, the connection fails.

CAUSE
This issue may occur if more than one computer shares the same source port. Windows Vista and Windows Server 2008 do not support tunnel-mode connections when the computer is behind an NAT device. Therefore, a conflict may occur.

RESOLUTION
A hotfix is available to resolve this issue. This hotfix adds the support for IPsec when the computer is behind a NAT device.

You can read more about it here and request the binaries here.