AD authentication for routed local subnet

Question

Good day,
I'm testing the addition of a routed local subnet to existing network and seem to be experiencing trouble with AD authentication.
Primary network:
Subnet: 192.168.0.0/24
Default GW: 192.168.0.1
PDC/DHCP/DNS1: 192.168.0.2
BDC/DNS2: 192.168.0.3
Routed network:
Subnet: 192.168.17.0/24
Default GW: 192.168.17.1
DNS1/2: 192.168.0.2/192.168.0.3
DHCP relay is configured and functioning.
Primary network gateway has persistent route for subnet 192.168.17.0/24 hopping via router IP 192.168.0.122.
Ping tests OK both ways and internet is browsable from clients in routed network.
Problem occurs when clients in routed network attempt to access domain resources in primary network. Using
net view //test-host results in 5 minute pause and then "Access Denied". Unable to view //test-domain/netlogon
I have added routed subnet to existing default-first-site in AD Sites and Services.
I'm certain I'm missing something simple here and will appreciate any advice.

Answer 1

Hi Christoffer, thanks for your reply.
There are no firewall rules active between the two subnets, however our primary network gateway is a Forefront TMG MBE firewall. To my knowledge this should not interfere with the inter-subnet routing however there could be access/policy rules that determine
how TMG (localhost) responds to traffic from routed subnet. Will need to look closely at this if AD authentication is not at fault.
The nltest queries also seem return successful responses:
nltest /dsgetdc:[DOMAIN]
DC: \\[PDC]
Address: \\192.168.0.2
Dom Guid: [GUID]
Dom Name: [DOMAIN]
Forest Name: [FOREST]
Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_FOREST CLOSE_SITE FULL_SECRET
nltest /dsgetsite
Default-First-Site-Name