IP Networking

OK, do a TRACEROUTE to get the path that the packets are traversing.
Then you will have a path of devices to check.

I hope it's not too late, certainly, the idea of traceroute is good, you also might want to consider "tcptraceroute" to help youy debug further - see the wiki example.

At the command line on the Windows server, try "tracert -d <host>". If the traceroute completes, then either you need linux or a fancier traceroute tool that works on Windows and which can send traces via a specific UDP port.

That doesn't bode well, does it? I mean windows 2003 has a firewall enabled, and then you have two firewalls in between your Wireless AP and the net, right? See if you can get the configuration of the iprisim and the firebox and post them here. Before posting, X-out any IP addresses to make sure your students don't get any ideas on playing Wargames.

I've heard that one before.

A year later the answer changed to "Oh, we've ALWAYS blocked that."

Definitely your Active Directory computer configurations should be checked. If the group policy prevents or any other systems such as ISA server is placed or any software firewall have been placed , you won't be able to connect to the internet. Start from the gateway and the DNS servers...And especially the internet server or the internet perimeter. May b a router...May be the gateway...Start from the internet gateway. And for campuses there has to be policy for internet usage...Try to scan a web site using nmap and check whether their is a block . It will do tracert too.Scan services also. Use latest version. Start from the smallest thing. The servers always have unique and dedicated IP s. So it will b easy when you have found the ip address assignment.
I think otheus sounds right.