The phone system can't be behind NAT - and as far as I know, that means PAT as well. If the ISA is ROUTING traffic, it should be able to work. External outside, goes through ISA, ISA sends traffic through to the secure side and the secure side has public IP addressing. This could be a DMZ area.

But don't NAT / PAT. Don't change it from <external address> to a 10.x.x.x or 192.168.y.y or 172.16.z.z.