Cross-realm network traffic...

[Jiva DeVoe]

In the case of cross-realm authentication (ie: user at REALM1.COM  
authenticating to service/foo at REALM2.COM) does any traffic pass  
between either the respective KDCs or does the user at REALM1.COM client  
need to contact the KDC in REALM2?

The context of the question is: if I have one or the other of the two  
realms behind a firewall, do I need to open any additional ports  
besides the traffic port for my service in order to support kerberos  
authentication?

(This is of course assuming the cross-realm principals are configured  
appropriately in each realm.)