I have Craig Johnson's "A Beginnerís Guide To BorderManager 3.x" (
Third Edition, Beta Version 1). The following excerpt is from page 46
under the section "Scenario 2 - A Cable Modem with DHCP Connection"

There is also one limitation to this scenario Ė the BorderManager
server will not be able to host VPN services. VPN on
BorderManager up through BorderManager version 3.7 cannot
function when the BorderManager server is behind a NAT

Does this hold true for BorderManager 3.8?