Failed to delegate credentials, check SPN

[sgrigg]

I get the following error when publishing a Sharepoint site using ISA 2006:

ISA Server failed to delegate credentials using Kerberos constrained
delegation to the Web site published by the rule Intra. Check that the SPN:
http/intra.usurf.usu.edu configured in ISA Server matches the SPN in Active
Directory.

This used to work, the SPN is definately still in AD. What else can I
check? When I try to access the site I get:

• Error Code: 403 Forbidden. The server denied the specified Uniform
Resource Locator (URL). Contact the server administrator. (12202)