How to configure 2 forest in Bigip APM

I'll assume that your Kerberos SSO profile uses the default "source" variables: session.sso.token.last.username and session.logon.last.domain. If so, then these are the values that you'll statically assign in the visual policy. You'll want to test with valid DOMAIN1 and DOMAIN2 user/domain information. You'll expect that DOMAIN1 user/domain information works, since it already does. The question then is if DOMAIN2 user/domain information works. Remember, you're hard-coding user information, so your Outlook profile config won't matter. It also means that this should definitely be an offline test, as anyone else accessing this environment could be logging in as the same user.