APM Kerberos Auth via/to app on physically seperate LTM - reverse dns issues...

That is exactly the correct answer. Summarised from the documents - basically create an SPN in AD for the LTM service.

I did not elect to do that at this time but have fallen back to NTLM in most cases.

Thanks for you help.