Sitting with a network admin watching the traffic, we logged into a crystal interface on the web server.  Network admin saw the servers talking to each other.  The login request went out from the web server and was received by the CE server, the CE server returned a list of reports we could run, and the web server displayed the list in the interface for us. 

 

Then, we chose a report and clicked "load report".  Silence.  The web server didn't even attempt to ask the CE server for the report. 

 

As I said, the exact same installation works fine on every internal server on the domain that we try it on.  Every time we try to take it off the domain and put it outside, this oddball thing starts happening.

 

There has got to be some configuration issue going on here.  I also had an external web farm that was set up years ago (so no one remembers how they did it) with CR10 that was working fine.  I wanted to duplicate the problem in this test environment so I took one of the servers in that farm, confirmed CR10 was pulling reports and working fine, then reloaded it with Server 2003 R2 and put the CR10 .NET piece back on it.  And BOOM- I sure did duplicate the problem...