When a browser requests the WSRP Consumer, the aggregation layer Portal proxies the request to the WSRP Producer (service layer Portal) providing the html back to the browser. The problem is that the resource url's (images, css and js) in the html all contain direct url's to the Producer server/portlet, when they should be being proxied through the Consumer Portlet either through a resource serving portlet or better still, a restful url to support further relative resources.
The issue can be seen clearly when using Firefox with the Firebug plugin to view the http requests.
The WSRP spec (1.0 and 2.0) states that if a Producer and Consumer are divided by a firewall, a client browser would still be able to use the portlet:
search for "the Producer may be shielded from the client via a firewall"