Forms based authentication against an untrusted Active Directory.

I'm using this article: http://msdn.microsoft.com/en-us/library/ms998360.aspx
When the user enters his user name and password, I query the AD domain controller with only port 389 or 636 open.
The query fails.
My connection string is correct, my dns is correct.
SSL is setup correctly on the server. (I can use ldp.exe and connect on either port and walk the AD tree)
Looking at the network capture, I can see the successful connect and bind with my configured connection user and password.
But the example app attempts to contact the untrusted Domain controller using netbios and port 445.  This of course fails because the AD I am querying is not a trusted forest and that port is not allowed between firewalls.
If I open netbios, everything works correctly.
From the capture I can see it uses NTLM when the netbios port is open.  It can't use Kerber ...