IPSec not through VPN

 Hi All,

I have the following situation:
- Windows Server 2003 behing ISA 2003 as the server that runs Terminal
Services(TS)
- XP client behind USR8054 NAT that is able to pass through NAT-T

I have created IPSec filter on the server to receive request on 3389 to
connect to the TS but only this port it requires IPSec from the client.
There is a CA installed on it, both sides authenticates with certificates,
not via kerberos, because they are not in the same domain (over internet)
On the client I have set the IPSec only respond rule. On the ISA 2003 I have
set the appropriate UDP rules: 1701, 500, 4500

Despite the connection is not working. I don't want to use VPN, only use
IPSec for this purpose.

What else should be configured, what else did I forget to set?

Any response would be appreciated.

Br,

G