Windows Server 2003 and IPSec tunnel

Hi everyone,

I`m stuck with a little problem.
One of my clients has a machine with Windows 2003 Server on it. It
serves as a database and licence server for a CAD application only
(it`s not a PDC or anything else, it has only one, local, network
interface).
Now client want`s to setup "VPN" - IPSec tunnel to remote office (they
have Palo Alto PA-2050, which will terminate tunnel). I`ve been
fallowing this KB -> http://support.microsoft.com/kb/816514, but no
matter what I do, I get only "Nnegotiating IP security." when I try to
ping far end of a tunnel
For matter to be more complicated, Win2003 machine is behind double
NAT (one for the office, one for building...).

Can anyone have any ideas/hint`s where I should be looking for errors
or smth?

Thanks