I had a similar issue and it took me about four months to solve it.
CheckPoint is the firewall/VPN end-point at work.
CheckPoint SecureClient VPN-1 (i think that's the name) is the client that is locally installed on users' laptops.
We also have SSL VPN setup, but its not published to all the users.
One specific user on a specific laptop would connect to the VPN but then wouldn't be able to access anything internal (ie: file server, Exchange, application servers, etc). I uninstalled the client and reinstalled it, played with the configurations (although we never had to), reimaged the machine, recreated the VPN account and the issue persisted. Strange thing was, the user was able to easily access servers and other internal resources when the user would connect with SSL VPN, so I had to do research on specifically how the two connectivity methods differed.
After reading many forums, I came across this MS knowledgebase article:
support.microsoft.com/kb/244474
The section of interest is:
"By default, Kerberos uses connectionless UDP datagram packets. Depending on a variety of factors including security identifier (SID) history and group membership, some accounts will have larger Kerberos authentication packet sizes. Depending on the virtual private network (VPN) hardware configuration, these larger packets have to be fragmented when going through a VPN. The problem is caused by fragmentation of these large UDP Kerberos packets. Because UDP is a connectionless protocol, fragmented UDP packets will be dropped if they arrive at the destination out of order. "
...which is basically saying that as the computers attempt to authenticate to the DC using Kerberos, larger, fragmented UDP packets involved get dropped, preventing the computers from authenticating (since there's missing fragments to make up the packets).
This made sense in my situation because the client configuration was authenticating and connecting to the VPN end-point, but everything after that point wasn't working because the computer wasn't authenticating.
I wish I had thought of asking the sysadmin who looked at the laptop to also look at the DC's event viewer to see if he saw any issues
Hope this helps or gives you an idea of where to go
