Use the Logs!
You can troubleshoot a lot of VPN problems by simply looking first for problems common to servers, user components, networks, and communications (don't forget ping and traceroute or tracert!); looking for matching pairs that don't match, permissions not given, and common obstructions; and don't leave out port sniffers and network monitors when things don't seem right.
But you can also get a lot of mileage out of logging, especially if you choose "Maximum Amount of Information" with Enable Point-to-Point (PPP) Logging on the RRAS Server, or run IPSECMON through Start, Run.
Even administrators new to VPNs can get a lot from logging. We often see USENET newsgroup posts where someone comes in with a question, and a Good Samaritan will try to get more information in order to help. When the person with the question doesn't have the additional informationsuch as what port the VPN is trying to usethe Good Samaritan typically tells him to run a log (and nothing else) in verbose mode, and dump the output to the newsgroup. Save yourself from that exercise by running the log first, and discover what clues it gives you.