F5 APM always on VPN

For the first one, this thread would be useful

https://devcentral.f5.com/s/question/0D51T00006uKEQiSAO/auto-connectalways-connect-to-vpn-even-if-the-category-is-domain-network?page=1

machine cert:

https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/big-ip-access-policy-manager-visual-policy-editor-14-1-0/03.html#guid-bb209ab6-68ab-4bf0-9c82-ac5e767f5816

The "About Machine Cert Auth" section

https://support.f5.com/csp/article/K15302653#link_02_07

https://support.f5.com/csp/article/K13614

Client cert:

K12169: Configuring passwordless client certificate authentication

https://support.f5.com/csp/article/K12169

For 2FA, i guess it really depends on which technology you're using.