F5 SSL Orchestrator Design

Hi,

 

I want to use F5 SSL orchestrator to intercept https traffic, so the traffic can be inspected by IPS (palo alto) and proxy (proxysg). My question are

 

1. I want to deploy layer 2 inline service for IPS. Does inward vlan and outward vlan have to use different physical interface ? Can I use vlan tagging for inward and outward vlan ? So it will use just 1 physical interface for layer 2 inline service.

    

2. I have 2 unit proxsg. Can i deploy one arm proxy and then use SSL orchestrator to load balance it ? My plan is connecting all of my proxysg to layer 2 switch and then connect the layer 2 switch to SSL orchestrator. Does it validated design ?

    

Please help

 

Thank you