I would look at cookie handling on the client machine. Or another conflicting VPN client.
I've seen the opposite happen. For example, on WinXPsp3 using IE8 / FF3.6 and IVE7.0, if you start NC using the NC client launcher, and connect/login normall, and the right-click the task-bar icon and select Exit, the tunnel is disconnected and the NC client exits. If you then open the NC launcher again (and you session hasn't expired on the SA), you'll be connected and logged in without prompting. I don't recall this behavior from 6.5 or prior, but I may simply be forgetting it.
In the users' NC client, is the correct URL displayed?
Do your IVE logs show successful connections from the user?
Is the user on a 3G/4G connection, if so, the carriers proxy server (esp. AT&T) is going to prevent the user from staying connected for more than a few minutes at a time, unless you allow unlimited roaming. When I've had this problem, my address changed from 166.x.x.x to 32.x.x.x after about 4 minutes. Since then, I force my connection to not use AT&T's proxy.
Is the user in a hotel or other captive-portal network, where the first connection must be an intercetpable HTTP connection, in order to be redirected to the ToS page. I had this happen in at least two locations, where if the first connection was not http that could be re-directed to the hotel's TOS page, and was instead an HTTPS connection, I would receive page not found in the NC client, or in IE/FF for that matter.
Another thing to check is the local subnet address of the XP client. If it conflicts with your SA's NC subnets, while the client will start, there won't be any connectivity because both networks are in the same address space.. I've not run into this in practice, but have been able to cause in a test environment.
