I've had this working before. You shouldn't need ip forward-protocol except for your DHCP forwarding.
If I remember rightly, the process is:
* Client does a DHCP request (which you forward using ip helper-address)
* DHCP server replies with a client IP address, and additional options giving the IP address of the PXE server
* Client then initiates a TFTP session to the PXE server to pick up its boot image (no ip helper needed, as this is a standard unicast UDP session)
* Boot image is then executed, and Altiris session can then kick in. I think it uses TCP 401 and 402 by default.
A few things you might want to check:
* Check your DHCP settings (default gateway, subnet mask) etc are OK. Can you ping the Altiris server from a client on VLAN1?
* See if you're picking up the boot image OK
* If you're using Altiris in Multicase mode, you'll need to turn on multicast routing on your router (PIM or similar)
Hope this helps a bit.
Alex.