Thanks rapier57, I learn a lot from your comments
However, the problem is the IP address of the servers are all public IP addresses. I can't change them to private IP addresses (because that will change the whole server system, while I'm just a newly assigned and unexperienced Admin)
So I guess I will demand the IP address for the upside port of the ISA Server computer from the ISP (in this case, it is SingTel), and the downside port IP address would be a public one