Network Access and Portal Access for Internal Web links

"For portal access, users are not "given" and IP address from an internal pool as with network resource. Portal access works like conventional LTM VS as-in a SNAT ip/pool is used to create a new connection towards your internal resource. So the internal resource will see a connection come in on an IP address which is internal and on the APM."

-- so, it is critical that I have either an ip or pool from an internal resource that will be recognized, or, simply that my internal self_ip needs to be that recognized internal resource? Because what I think you're saying is that for that resource, when the user uses vpn, there has to be a termination on that internal ip for it to work.