ISA 2006 and Exchange 2007: ActiveSync error 0x85010004

After the ActiveSync role on my Exchange Server 2007 was published through ISA 2006, my Samsung i600 running Windows Mobile 6 started showing this warning:

"Your account in Microsoft Exchange Server does not have permission to synchronize with your current settings.  Contact your Exchange Server administrator.
Support code: 0x85010004"

Previously, it had been published through NAT, and I had never seen this warning. I could no longer synchronize the mobile device.

Change the ActiveSync virtual directory

To fix the problem, locate the Microsoft-Server-ActiveSync virtual directory in IIS MMC and clear the Require secure channel (SSL) checkbox. Restart IIS.

This fixed my problem. Make sure you configure the internal SSL bridge to encrypt data behind the ISA firewall. Communication between ISA and Exchange 2007 is not encrypted, which is fine for a lab. For production, generate a computer certificate at both ends for encrypted communication.