Also, not sure what client you're using, but you may want to try to establish your tunnel before the users login. See the post from Howard from the other day on this using the Cisco client.