Some of the strategies to harden a VPN Network are:

Quarantine Control
Quarantine Control provides phased network access for remote (VPN) clients by restricting them to a quarantine mode before allowing them access to the network. After the client computer configuration is either brought into or determined to be in accordance with your organization's specific quarantine restrictions, standard VPN policy is applied to the connection, in accordance with the type of quarantine you specify. Quarantine restrictions might specify, for example, that specific antivirus software is installed and enabled while connected to your network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. A timer setting is also available, which you can use to specify an interval at which the connection is dropped if the client fails to meet configuration requirements.

VPN client credentials
The credentials received by Forefront TMG when a user connects through a VPN client connection can vary depending on the connection scenario.
When a user establishes a VPN connection from a client computer, Forefront TMG associates those credentials with the connection. Note that if other users use that connection, Forefront TMG will not receive their credentials, but will continue to associate the traffic with the credentials used to establish the connection, which could be a security concern. This would be the case if users use Terminal Services to connect to the client computer and then make requests over the VPN connection. Another example is if the client computer is configured to act as a network address translation (NAT) device, allowing the VPN connection to be shared among many users on different computers.

Site-to-Site VPN Connection
A site-to-site