You will need to let udp srcport=500 destport=500 through for IKE (Phase 1) to work. You may also need to allow the ESP protocol (protocol id is 51), if you do native IPSsec.
If you do NAT-T (ipsec over udp) you will need to allow udp destined for the 3005 unit on what ever port nat-t is configured to listed on, which I believe is port 4500 by default.
The 3005 can be configured to run IPSec over TCP, and there is a range of ports, that you can configure, as well as just one port. The default is port 10000 only.
The 3005 can be configured to do all three types of IPSec sessions, so you may want to leave all the options open. Mostly because the policy where the remote client may dicate one type (such as allowing ipsec over tcp only) to aid in NAT.
The 3005 can also be configured for PPTP - to do this you need to allow the control session inbound (I believe that it is tcp port 1743), as well as GRE in both directions between the 3005 and the remote client.
I hope this helps.
