TCP Traffic Path Diagram

@Aurel , F5 is a statefull default deny box, you have an entry in the conn table for every flow(pair). If you want to use your F5 like a router then you have to make your device as close to a router as possible. Routers dont act on flows they just do Destination lookups. Now back to the default deny bit, if you dont have a flow and your not a syn frame then by default your in the bit bucket to get around this there is the "loose initiation" : which as quoting f5 : "The Loose Initiation option allows the BIG-IP to initialize a connection when any TCP packet is received, rather than requiring a SYN packet for connection initiation." As far as i know from a conn table perspective there is no discrimination between a forward or a standard etc VIP they are all just mappings of translations (inside local, inside global, outside local, outside global)