Network Access and Portal Access for Internal Web links

Webtop links are as you explain just links so that the user can conviniently access those resources from the webtop.

Portal access is when you want to provide access to resources within the network from outside but only after a strong authentication/client-side checks, etc. , etc.

For portal access, users are not "given" and IP address from an internal pool as with network resource. Portal access works like conventional LTM VS as-in a SNAT ip/pool is used to create a new connection towards your internal resource. So the internal resource will see a connection come in on an IP address which is internal and on the APM.

Talking about rewrite profiles, it really depends on the application. Some applications respond with content which has links embedded in it which are pointing to other internal resources referreed with internal DNS names/zones. When this content is received at the client, the client may not be able to even resolve these names and connect to them. This is where a rewrite profile comes in handy. The rewrite profile will replace all links with an externally resolvable link and map it back to an internal link. This will force access to the other internal resources to also go via the APM.

Best !!