I use this format quite a bit. Put APM on an external vip, and use an irule to direct traffic to standard internal vips. This lends itself well for use with split horizon DNS, and permits easy remote access. Using a wildcard certificate or SNI with multiple client ssl profiles makes this extremely flexible.