Lync SSL Config

It does seem like a routing issue. The iApp wasn't designed with this kind of setup in mind, although it's a scenario we can investigate and possibly add into the iApp. I see no reason why you would need both external and internal reverse proxy VIPs when deploying on one BIG-IP (or HA pair); you could copy the iRule that secures access to the external reverse proxy VIP, then reconfigure the iApp and NOT deploy the external reverse proxy VIP. Change the destination port on the VIP from 4443 to 443, and add that iRule to the internal reverse proxy VIP to secure access and you should be OK.