VPN authentication problem

Hi

I have Windows Server 2003 R2 SP1 with ISA Server 2006. Server has 2 NICs,
there is one internal subnet.

I configured VPN server through ISA Server Management panel. Address
assignement is from static pool, the only authentication enabled is
MS-CHAP2, no RADIUS server is being used.

The problem is when I try to connect to the server through VPN from Windows
XP SP2, I get the following error:
Error 691: Access was denied because the username and/or password was
invalid on the domain.

Of course, this is not true. In the server's Event Log I get the following
error:
Event ID: 20014
Source: RemoteAccess
Type: Warning
Description: The user DOMAIN\UserName has connected and failed to
authenticate on port VPN3-9. The line has been disconnected.

The only help I've found on the Internet mentioned problems with Windows
9x/ME acting as clients. There is nothing about XP client. I tried to enable
weaker authentication protocols (MS-CHAP, CHAP, PAP) but I didn't work.

I can't figure out what's wrong. Please help.

Bes regards
P. K.