I was having a somewhat similar problem with a remote site connected via a hardware VPN. Like you I forced kerberos to use TCP instead of UDP. But I also had to change the MTU size on all of the ...