Kerberos Auth - Captive Portal

Hi

I'm trying to get a transparent proxy working using kerberos authentication.  I believe all I'm missing is a captive portal to facilitate the kerberos authentication. When I enable the captive portal on the lan interface, I have to exempt all addresses used in other policies that traverse this interface, which seems crazy. Is this expected behavior, or am I doing something wrong?

Does anyone have a good guide on setting up kerberos auth for a transparent proxy?