IPSec tunnel works to one concentrator, not another

Archived from groups: comp.dcom.vpn,comp.dcom.sys.cisco (More info?)

I'm trying to get a user in another city to connect to one of our 3005
concentrators using IPSec/TCP (we've also tried IPSec/UDP) and the
Cisco VPN client 4.0.1. So far, we can't seem to get past a certain
point. Where I think it's trying to ask for a username and password
(after checking the certificate), I get this in the logs:

Xauth required but selected Proposal does not support xauth,
Check priorities of ike xauth proposals in ike proposal list

and the client eventually gives up.

If, as an experiment, I get him to try connecting to our other 3005,
which should be very similar in configuration, he connects fine.

I've compared the two configs and I don't see any differences in the
IPSec stuff. What should I do to get this problem fixed?

Thanks!