F5 multi-arm mode design.

OK, so what I'd call one-armed mode =]

 

 

This is a valid design. I'll always prefer having the F5 'in-line' and thus removing any need for SNAT (the route to clients is always through the F5 even if it isn't the first hop). An alternative of course is to have a flat VLAN server-side where the F5 is the only IP gateway (a stub if you will) - this provides the most flexibility and the easiest troubleshooting.

 

 

If you ever need to do 'double bounce' - use the same LB to LB to web servers and then from the web servers to app servers one-armed mode will involve two SNATs, one per VIP. This can make tracking a single connection/flow very hard. In-line mode reduces this to one SNAT on the second VIP. Stub mode (if I can call it that) avoids SNAT altogether.