I am trying to get a better understanding of Kerberos/NTLM in my setup. We have 2 WFE,1 backend and separate SQL cluster in domain1. The site has anonymous access enabled. We have another domain (domain2) that has a DNS entry for our site, and uses NAT to get back to the WFE on domain1.
Im logged into domain1 and when I access the site I can see Kerberos as the auth method in the event log.
When im on a pc on domain2 and I access the site (unauthenticated at first), then when I login using my domain1 account it recognises me ok. However, if I look at the event log there is no mention of kerberos, only NTLM. I would now expect a double hop issue when I try to open a word doc, in that it will ask me for my credentials again. It is not and the doc opens. Can someone clear up this last point for me please?