
Explanation/Reference:
Explanation:
Box1
Leave Server1 as a standalone server.
Box2
Install the Web Application Proxy (WAP) role service and configure the service.
Box3
Configure Kerberos constrained delegation.
Web Application Proxy can be deployed without joining the server to an AD DS domain or by joining the Web Application Proxy server to a standalone domain in a perimeter network.
The Web Application Proxy role service is a replacement for the AD FS proxy role.
When publishing applications that use Integrated Windows authentication, the Web Application Proxy server uses Kerberos constrained delegation to authenticate users to the published application.
References:
https://technet.microsoft.com/en-us/library/dn584113(v=ws.11).aspx
https://technet.microsoft.com/en-us/library/dn383648(v=ws.11).aspx