I have an Exchange 2010 CAS at a second datacentre (but part of the main exchange org and domain) and I am trying to publish EAS and OWA from it through TMG. The name that is being published is drwebmail.contoso.com as opposed to the main site which is webmail.contoso.com. The FF TMG server is currently sitting in the DMZ and is not domain joined, and resides on the same server as the Edge Transport role (don't ask - it's not my design).
I have set this up with the same settings as my main site (where OWA and EAS are published through a domain joined ISA). When I go to ExRCA i get the 401 unauthorised error.