Adding Exchange Servers to Relay Connector stops mail flow

Hi - I have introduced 2013 into a 2007 environment

In 2007 we have 2 HUB Servers and each has a Receive Connector to allow permitted servers to send email

All Exchange 2007 Servers are added to both Connectors (for Powershell reports etc)
I have added all Exchange 2013 Servers to the Connector on HUB1 and mail is flowing

NB there is an entry in DNS 'relaysmtp' which currently points to HUB1

If I add the Exchange 2013 Servers to the Connector on HUB2 mail stops flowing from 2013 to 2007
The SmtpRelayToMailboxDeliveryGroup queue grows on the Servers added with error:

LastError : [{LRT=18/01/2014 14:43:16};{LED=451 4.4.0 Primary target IP address responded with: "451 5.7.3 Cannot achieve Exchange Server authentication." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts. The last endpoint attempted was 2007 HUB Server:25}

The Authentication on each Connector is currently: TLS, Externally Secured
The Permission Groups on each Connector are: Exchange Servers

So currently, if we point 'relaysmtp' to HUB2 (it is a FSW) then the Exchange 2013 Servers will not be able to send email (Powershell reports etc)

Does anyone know how I can add the Exchange 2013 Servers to the Connector on HUB2 without preventing mail from getting stuck in the SmtpRelayToMailboxDeliveryGroup queue?

Thanks

---

shapi