Embarrassingly enough i was stumped on a escalated support call today where the users on a different subnet were constantly being prompted for their credentials and were unable to access the CRM system through the client.
This was a IFD deployment (so i should of twigged immediately!)
The solution was to add the subnet mask into the IFDTOOL.
Oh well .... you live and learn!