Hi,
You may have several issues here :
- Invalid SPN configuration,
- Kerberos token too big (> 32 Kb),
- ...
What is the behavior observed when putting the bigip device in front of the application ?
If you start a packet capture or an HTTP trace on the browser (Burp, httpwatch, fiddler, Developer tools, ...), you may see if you get a response 401, a tcp reset, a basic fallback or some other things you may find.
APM module is required when you require to terminate Kerberos authentication on the bigip device which is not the use case you described. So APM is not required in your situation
Yann