LTM Configuration for kerberos

I have gone through the LTM implementation guide few times, but I am still not clear if LTM has to be configured for Kerberos delegation.

 

There are two Web servers(IIS 8) with Kerberos only authentication (Negotiate : Kerberos) set. SSL is terminated on IIS; LTM is used to load balance only and there is no SSL offloading on LTM(SSL pass-through).

 

Web Server Configuration: 1. SPNs are created for each Web Server and the DNS used in the LTM 2. A domain account is used for the Application Pool Identity to decrypt the kerberos tickets on any server behind the load balancer. Domain account is configured with “Trust this user for delegation to any service (Kerberos only)"

 

Can someone please let me know if the following steps are correct for the LTM?

 

1.Create a Kerberos Delegation configuration objects for each Web Server (SPNs) 2.Create a Kerberos delegation profile objects

 

3.Create load balancing pools to load balance SSL traffic 4.Create virtual servers. Assign the Kerberos Delegation profile to the virtual server by configuring the virtual server’s Authentication Profile setting