Negotiate:Kerberos Authentication in Load balanced webservers

Hi All,
I have to implement forced Kerberos authentication for an ASP.Net intranet website deployed on load balanced webservers.  
AD & Load balancer web servers are in same domain.
Web & DB Server: Windows Server 2008 R2
IIS: 7.5
DB: SQL Server 2008 R2
The virtual directory is setup and provided service account access on both VD & on SQL server db, authentication changed to Negoticate:Kerberos and unchecked the "Enable Kernal-mode" in IIS.
I am completely new to Kerberos authentication. I have googled to learn something about kerberos but not able to understand the need of SPN setup, Keytabs etc.
Is SPN and keytab file must for Kerberos authentication in IIS? Both SPNs and keytab setup will be done from AD or from web serve ...