Transparent Authentication for Network Access VPN in APM

the line you quote comes from an article about kerberos SSO, something which im not sure you need to do with network access. as you can see it often relates to portal access where your client isn't able to do SSO itself, but the APM has to do it for the client.

with a VPN your client can do much more, as it has "full" network access, you might not have to do SSO.

so are you sure you need to do kerberos SSO or just want to do kerberos on the outside to authenticate against the APM?