Information on redirection

HI Guys, So i have two front end servers behind my f5 VIP. . Now when i hit xyz.com it gives me the default redhat page from the servers. Now the application on the servers are using the uri . So the certificates are on the server and i am using the VIP as a Layer 4 VIP on https.

My question is when i type xyz.com/ecmlogin it takes me directly to the active server. ( I can see the server hostname on the browser. I tried to check the network traces and it seems the server is redirecting with 302 twice. Can someone let me know why i see traffic directly going to the server instead of the F5.