Many thanks for your replies Clembo and Victor.
Unfortunately I do not have a network diagram Victor, I was going to describe the network but will spare you the description as everything appears to be working.
I deployed a new site for the customer yesterday, same setup as the previous site, local 650 etc.. and everything worked. I checked the site I had an issue with and saw client associarted and authenticated and I could ping this the local controller and then new site I was setting up. I suspect there was an issue with the customer's laptop when we initially tested, I know he'd been doing some funky routing on it the previous day.
Clembo - everything you mentioned was verified, I should say a very good check list for anyone else looking into configuring this scenario, which confused me greatly as everything looked like it should have been working. Funky routes on the testing laptop would explain this.
Thanks again for replying.
Mark