spnego kerberos header vs ntlm header

Here's a great article that speaks to exactly what I mean: http://blogs.technet.com/b/tristank/archive/2006/08/02/negotiate-this.aspx

The first thing I would do is start logging HTTP request headers to see what you're actually getting. You'll notice right away what the differences are in size and can tweak your iRule accordingly. Here's a simple logging loop for request headers:

when HTTP_REQUEST {
    foreach x [HTTP::header names] {
        log local0. "header($x) = [HTTP::header $x]"
    }
}

You're looking for the "Authorization" header. Once you've determined an appropriate size constraint:

when HTTP_REQUEST {

if { [HTTP::header exists Authorization] } {

if { [expr [string length [HTTP::header Authorization]] <= ] } {

pool NTLM_pool

} else {

pool Kerberos_pool

}

}

}

Give that a try.