I couldn't find this documented anywhere else, so it goes here! By golly, you can find ALL KINDS of solutions here at use.perl.org - some that might even have to do with Perl!!
keywords: cisco softphone audio firewall vpn nat
If you have one-way audio (specifically, they can hear you on your softphone but you can't hear them), check the following:
Settings -> Audio -> Network Audio Settings
The top group of radio buttons has three settings:
On my laptop, the second button was selected (which was correct), but my wireless router's NAT IP address was chosen. Once I selected the address provided by the VPN concentrator, all was well.
I found information on Cisco's site that referenced having to open UDP ports 16384 through 32767 inclusive (HELLO!), other stuff elsewhere saying that I should change my router's config to put my laptop in the DMZ, blah blah blah. All unnecessary.
I'm working with a gent from Colorado on a script that helps Novell BorderManager admins have an easier time of dealing with access control lists. He's got the code working, I'm doing a little polishing and PODding.