BIG-IP in DMZ - Reverse traffic to public subnets clarification

Hi guys,

Please help with understanding routing on BIG-IP LTM device. We are using quite old version on the box - 10.2.4. The problem we are having is related to traffic flows from border firewall which is connected to public subnet and F5 load balancer. We are experiencing connectivity problems from outside to server pool behind the load balancer after we perform switch over operation on firewall cluster from primary to secondary node. Both firewall devices are in sync so they are using the same configuration and during switchover the secondary device just taking VIPs from primary. I suspect that the issue lies on the LTM side.

What I can't understand right now is how BIG-IP is returning traffic back from the pool to the clients in the Internet if the load-balancer is in the DMZ already (it doesn't have public IPs assigned). Border firewall perform NAT translation for destination IP address leaving the clients public IPs unchanged. This changed packet is reaching LTM vServer in the VLAN20 (please take a look on the attached diagram) and based on the vServer settings traffic is directed to POOL of Web servers with source changed to self-IP of LTM (because of SNAT automap config). But the reverse path is not clear. Traffic is forwarder to LTM which in its turn will substitute original public IP address of the Internet's client. What then? Traffic will be directed based on routing table? But in that case asymmetric routing will happen because in our case default route is pointing to different VLAN.

Here is our vserver config

    ltm virtual VS_VSERVER {
  destination 10.0.20.150:https
  ip-protocol tcp
  mask 255.255.255.255
  partition APP20
  persist {
      TST_cookiePersistence {
          default yes
      }
  }
  pool POOL_WEB1
  profiles {
      TST_http_headerSource { }
      example.com {
          context clientside
      }
      tcp { }
  }
  rules {
      TST_redir
  }
  snat automap
}

Thank you very much!