I'm seeing this in my log for a particular user:2009-05-08 08:46:15 - ive - Closed connection to TUN-VPN port 443 after 727 seconds, with 3033 bytes read (in 18 chunks) and 1688 bytes written (in 15 chunks)
I'm guessing but...
I would check the users local system events - this smells of something going on unique to that machine. Like wireless WEP re-keying cauing a drop (I've seen that in the past).
Have them run a continouous ping (ping -t) to make sure it's not ARP or something similar.
It can't be roaming... I've seen roaming issues with broadband cards and the IVE will have logs showing that UserA changed from IP X to IP Y (regardless of whether it was allowed or not), so if you're not seeing any accompanying logs about his IP address changing then it's not that.
Definitely sounds like a connectivity issue on the client's end. When they say they have to reboot because it's hosed do they mean even after disconnecting NC they still can't surf the internet or anything? Sounds then like this would happen every 40 minutes even off the VPN.
Under Authentication - Endpoint Security - Host Checker check to see what your "Perform Check Every" and "Client-side Process, Login inactivity timeout" settings are set to. I bet it's 40 minutes.
I have experienced this problem with some of the IVE versions (not all of them!!) and the work around it to up these settings to a value higher than your Session Timeout in the user role.