NTLM fallback path is not been selected

you could see if it works with kerberos, there is some discussion about that here and i have seen this working: https://devcentral.f5.com/questions/kerberos-401-authentication-with-form-fallback

afterwards you could go back to NTLM and see if that works.

this is a little bit more what you want, but they use different selections to go for NTLM or forms

https://devcentral.f5.com/articles/leveraging-big-ip-apm-for-seamless-client-ntlm-authentication