Lync 2010 Mobility Sign-in not working from external

I've now managed to resolve the issue, and we've got Mobility working 100%... During testing over 3G all clients where consistently getting the message regarding invalid credentials despite the RP showing successful authentication, so I tried using the mobile client with an incorrect AD password - the RP showed the invalid attempt, and subsequently the AD account became locked out. To cut a long story, I moved the port 443->4443 forwarding to take place on the firewall rather than as part of the RP policy, and it all worked. It appears that allowing the RP (in my case a Juniper MAG) to the do the forwarding was preventing the return traffic from reaching the client