When an external user tries to access OWA that is published in ISA Server 2006, the user does not receive the OWA forms-based authentication page

The below Microsoft article explains that when using validation methods such as RSA SecurID with the OWA Forms-based Authentication, users do not receive the OWA logon form.

For more information and to find out how to correct this issue, refer to https://support.microsoft.com/kb/935206/en-us