Please help me understand what is going on:

I have a web server sitting in the DMZ. I have an app server sitting on the
inside on the firewall. THe Web server talks to the app server using .net
remoting over port 80. I use the http channel and binary formatting. I am
using the Trusted Subsystem model. I have changed the ASPNET account on both
servers and in their respective machine.config files. Before I have moved the
web server to the DMZ, this arrangment worked fine and I was able to
autheitcate under the ASPNET account to the app server from the web server.
After we moved the web server to the DMZ, I now get "The remote server
returned an error: (401) Unauthorized. ". THe weird thing here is if I use
the Identitiy Impersonate element in the web.config and add the ASPNET
account itself, i get access !!!!!! So it seems the aspnet worker process is
picking up some credentials from the machine.config file that are not what I
set. Because if I do the same using the impersonate element, same ASPNET user
account and same password from the machine.config file (i put that in the the
identitiy element), i get access to the app server on the other side of the
firewall. Any ideas?

thx.