[Dovecot] Apple od/ad authentication problem

Hello all. Im pretty new to dovecot and postfix world. I'm completely stumped.

OS X 10.7.3, behind a Cisco asa NAT.

When trying to authenticate (ssl or not) via the webmail interface I get this error...

NAT IP is the public ip I assigned.

It doesn't work for an AD account or an account local to the Mac server. However it DOES work on the internal LAN.

Feb 22 18:15:36 mail dovecot[3501]: auth: Error: od (username,natIP): verify plain: lookup failed for user: username

Feb 22 18:15:51 mail dovecot[3501]: auth: Error: odgetpwnam_ext: No record for user

I figured I'm missing something in the dovecot config. I have followed apple's kb articles for AD webmail authentication and kerberos, and that works internally.