APM Kerberos Auth via/to app on physically seperate LTM - reverse dns issues...

Hello

I have an APM resource who's target is a physically seperated LTM VIP (with no APM). I would like to enable KRB auth to this VIP.

To do this the LTM VIP has to have reverse DNS resolution consistent with the SPN of the server behind it. That would be OK if there was only one server - multiple PTR records would be required with more than one server behind the vip - this is an illegal configuration which will only return one PTR at any time.

For a policy, architectural and operational reasons I do NOT want to redefine the pool members and vip directly on the APM box. However I find little other choice that will enable KRB to function? Am I in error? Is there a solution I have missed? I will probably go back to NTLM as I DO have the users password.

Thanks in advance for your help :>