Sometimes you will find your server sat behind a proxy designed for human traffic rather than server traffic and so requires authentication.
Although the NTLM protocol is grossly insecure it still seems to used in a lot of proxies. To get your server to download updates you will need to make your server play nice with this authentication as a lot of software does not support the NTLM protocol.
CNTLM solves this issue by adding another proxy layer in front of your software which does not require authentication.