APM - app tunnel restrict

F5 should have connectivity to internal resource. It doesn't need to be exposed to outside (external) VLAN. Apptunnel needs to be configured using the destination (either IP or hostname) of target resource, port, parameter and path of the application (optional) e.g. if it's VMware horizon client, path of the application can be set. Finally apptunnel needs to be published on the webtop.

You can refer more info here

https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-application-access-11-4-0/1.html