supporting a http2 sni website with f5 ltm?

I believe you're on the right lines by including the server name in the server SSL profile, but I think (even if there's only one profile) you have to enable the "serverssl-use-sni" feature on the Virtual Server: https://support.f5.com/csp/article/K39408450

If that isn't working then you could probably pull the SNI field out of the server side connection using iRules and the SSL::extensions command. Kai_Wilke has an example of inserting the SNI header here (which is an alternative for versions earlier than 15.1.x or if you didn't want to use multiple SSL profiles and the serverssl-use-sni featurea) which could be used as the basis to build a rule to extract and log the header instead.

Not to rock any boats, but the distributed cloud prefers SNI. It's remarkably easy to get going.

Where are you seeing the problem - is it on the back-end SSL handshake? What is the serverSSL profile configuration? Does the server.internal.com server have a wildcard certificate as well? 

Sorry for the ignorance; what is "the distributed cloud"?

So the problem is only that ur sending app.external.com to your node but you have this hostname not configured and your node only listen to server.internal.com? So a simple Hostname Header rewrite is enough? Then create a LTM Policy with when host is app.external.com rewrite to server.internal.com 

iRule for logging? something like this 

when HTTP_REQUEST_RELEASE {
   log local0. "Client [IP::client_addr] This is the HTTP Host [HTTP::host]"
   log local0. "Query string of URI: [HTTP::uri] is [URI::query [HTTP::uri]]"
}