Solution For O365 SSL forward Proxy ByPass

So minimally you'd have two pools:

1. The pool of BC proxies
2. The pool of routers on the other side of the BCs

Based on some criteria, you'd select the BC or router (bypass) pool. The question then becomes what criteria to use. If you know the destination IP addresses for O365 resources, then it's super easy to switch pools based on the destination IP. If you don't know the IPs, and because you're not decrypting at the F5, you may have to collect and use the ClientHello SNI value (for encrypted traffic) or the HTTP host header (for unencrypted traffic).