I'll answer my own question, I got this working on IE11.
On the Windows 7 machine in question, I have:
-Added the site to IE11's trusted sites.
-Set security to Low on Trusted sites. Intend to play with this and see how high it can go.
-Tools > Internet Options > Advanced Tab > Security > Enable Enhanced Protected Mode (and rebooted). This makes IE11 (or 10) run only in 64bit mode.
- Tools > Internet Options > Security Tab > Enable Protected Mode.
-64 bit Java installed. Java 7 Update 67.
-Have Microsoft Visual C++ redistributables installed -- 2005, 2008. Note: 64 bit only installed.
-- 2005: no explicit version listed.
-- 2008 has 3 versions installed: 9.0.30729.6161, 9.0.30729.4181 and 9.0.30729.61651
- I also set Tools > Internet Options > Advanced Tab > Security > Allow Software to run or Install even if the signature is invalid. Not sure this mattered, but I intend to disable it after things install the first time. EDIT: This setting is not needed. The Active-Xs Install and uninstall with it unchecked.
-IE Emulation (F12 key): This is the key/big secret, it works different in IE11 than in IE10:
-- F12 Key > Scroll down to Emulation (funky looking icons on the LH side) > Document Mode = 9, User Agent String = default (no change). If you change it when on the VPN Tunnel/Portal webpage, then the screen redraws and the two installs start right away.