you can't you have to use one or the other. Look at the White paper on
Extranet and you wiull see that you need to have a separate web site for each
type access  but they all point to the same physical locations.

I believe he is correct. If you have IIS set for Allow Anonymous and Windows
Auth, the user  entering the site will always be running under the anonymous user
account since it is “checked” first. No need to check via windows  auth since
anonymous is allowed. Separate sites set for separate security models would be
the answer.