dovecot - Feb 2012 - Apple od/ad authentication problem

Hello all.  Im pretty new to dovecot and postfix world. I'm completely
stumped.

OS X 10.7.3, behind a Cisco asa NAT. 

When trying to authenticate (ssl or not) via the webmail interface I get this
error...

NAT IP is the public ip I assigned. 

It doesn't work for an AD account or an account local to the Mac server.
However it DOES work on the internal LAN.

Feb 22 18:15:36 mail dovecot[3501]: auth: Error: od (username,natIP): verify
plain: lookup failed for user: username

Feb 22 18:15:51 mail dovecot[3501]: auth: Error:
od[getpwnam_ext](username,natIP): No record for user

I figured I'm missing something in the dovecot config.  I have followed
apple's kb articles for AD webmail authentication and kerberos, and that
works internally.

On Fri, Feb 24, 2012 at 08:55:57AM -0500, Troy Shafer
wrote:
> Hello all.  Im pretty new to dovecot and postfix world. I'm completely
stumped.
> 
> OS X 10.7.3, behind a Cisco asa NAT. 
Deactivate the SMTP improvements your ASA helpfully provide.

Dennis

[..]