Does F5 have any feature similar to this Cisco one to detect when the client is behind a portal that requires additional action to get outbound to the vpn server? I think this is a very key feature to using an always on solution.
http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/118086-technote-anyconnect-00.html
The Edge client has Captive Portal Detection built-in since 11.5.0. (https://support.f5.com/kb/en-us/products/big-ip_apm/releasenotes/product/relnote-apm-11-5-0.html) search for 'captive portal'