I have a client with set up with Kerberos authentication. Inside their network it works beautifully.
It's a 4 server farm: 2 WFEs behind a load balancer (kemp), 1 App/CA server, 1 Office Web services server.
They have their IE set up to "automatically use current credentials" for the zone their SharePoint URLs are in.
When they take their domain attached laptops off the network and try to log in using IE, it fails instantly with a page cannot be displayed. Using the network debugger, it turns out that they're getting a 401 error, asking for authentication.
Firefox and Chrome work, but they have to log in, presumably because they don't use kerberos and we have NTLM configured as a fallback.
When we examine the firewall logs, there are dropped packets from port 88 trying to reach an AD DC from the test computer we have set up on an external network. It looks like the computer is trying to talk to the DC even though it's outside the network.
Is this expected? Is there something wrong with this configuration?