Hi,

I'm having a problem with the following architecture:

Web services hosted on server A which is a windows 2000 machine.
Sharepoint web app on server B which is a windows 2003 machine.

Server B calls the web services on server A. The sharepoint site is
configured to require intergrated windows authentication.

Both server A and server B belong to the same domain controlled by a windows
2000 domain controller (server C).  Server B is trusted for delegation in
active directory on server C.

Now when I browse to my sharepoint site from any machine on my LAN and enter
credentials for a domain account set up on server C everything works fine.
Server B creates the web request, gets a KerberosToken2 and signs the message
and sends the request to server A.

However, when there is a firewall between the browser and server B the
creation of the KerberosToken2 on server B fails with the following message:

A specified logon session does not exist. It may already have been
terminated.

For the purposes of this test I allowed any traffic to pass through the
firewall to server B (or at least I think I did), but it still doesn't work.

My question is should what I am attempting to do be possible? And if so what
steps do I need to take to make it work? Also I need to find out the minimum
firewall settings which will allow this to work in the real world.

Any help would be greatly appreciated as I've come very close to getting a
workable solution now.

Thanks in advance.

Julian Jelfs.