This very good article describes and explains a very common scenario that I've seen a cuple of times in customer environments:

http://www.isaserver.org/tutorials/Advanced-ISA-Firewall-Configuration-Network-Behind-Network-Scenarios.html

Urs