[Help-gnu-radius] Authentication from Windows 2000 VPN client

[zliu1]

When Windows 2000 VPN client tries to authenticate, the radius.log file
shows

    Jun 18 16:47:07: Auth.notice: Login incorrect: [USER_ID/]: CLID
       unknown (from nas xxx.xxx.xx.xxx)

    (the nas is a Cisco VPN 3000 Concentrator)

I set to let Radius to record wrong password. Why the password could not
be seen by the Radius server? I set Windows VPN client either to use
"Typical (recommended setting) - Require secured password" or to use
"Advaced (custom setting)" with PAP/CHAP.

On Radius server, I set "Auth-Type = Pam".

What is the correct setting to authenticate a Windows VPN client?

Thank you,
Zuwei