Allow NCSI traffic through Forefront

Hi,

I have recently installed ForeFront TMG 2010.

I am very familar with ISA 2000-2006, and TMG in general.

WIndows vista and later clients indicate network and Internet Connectivity status with the NCSI icon in the system tray.  I can't seem to get this to work with TMG in the loop.  I have added a non-authenticated rule allowing access to the NCSI site (http://www.msftncsi.com/ncsi.txt) and, I can confirm that I can browse to here and see the text file, but I cant get NCSI on client machines to see the Internet - they all display "No Internet connection" (despite having access to the Internet :-) ). 

What do I need to do to fix this?

Thanks