Also, you might look into this: http://support.apple.com/kb/HT4748
You can find the shortname for the vpn user in Workgroup Manager->View System Records
This is the solution that worked for me when using L2TP, and only the server admin could login as VPN user.
In vpnd.log there should be an error about 'failing to retrieve MPPE encryption keys' for the user trying to logon. Maybe best if you check that first.
To follow up for future searchers:
Apple support article: http://support.apple.com/kb/HT4748 was very helpful, but it still did not resolve the issue. What is import to mention although, is PPTP works with domain accounts, L2TP with Local Accounts in all cases. I believe the bug in Lion is a little more deep seated in some cases, this one being an example. I have worked around the issue by having my client connect with PPTP and the directory admin account, but accessing the file share with her authentication info (her open directory account).
I am also seeing a similar issue.
But some background first... I had originally exported Open Directory accounts from a 10.5.x server and imported them to the 10.7.4 server. I then had passwords reenterd individually for the acounts, but couldn't get VPN to work even on site. I ended up having to delete the accounts and recreate them individually, but with the same UID in order to get internal VPN to work.
Now I can login with domain acounts through PPTP from off site, but can't login at all with L2TP from off site. I can login with both from on site. I have disabled firewalls on the router and server - temporarily - just to make sure that wasn't any issue... and it wasn't. I have also routed everything through the router so that shouldn't be the issue either. The only log entry of value I can find is below after seeing similar messages saying transmit and receive were successful 4 or 5 times.
racoon: IKE Packet: receive failed. (Responder, Main-Mode Message 5).
Any ideas or resolutions?