redirect tcp traffic for inspection

I am trying to utilize LTM for load balancing 2 content scanning engines ..

 

 

Here is the setup:

 

 

Content Scanner Farm 1, 2 , 3

 

| |

 

internet <--------------> F5 LTM<-------------->intranet

 

 

 

 

Traffic is TCP 3900 (this is an internal app - it is not http)...

 

 

Content scanners can work in layer 3 routing mode but they are not the final destination of the original traffic.(like a web server).

 

Traffic source and destination addresses are random.

 

 

We want F5 to intercept all TCP 3900 and redirect the traffic to the content scanner farm

 

Scanner farm is directly connected to F5 LTM on a different segment/switch

 

 

Traffic is eitherbound..

 

 

 

What I want to do is have the F5 LTM inline in layer 3. And when the traffic hits the LTM I want to redirect only the the TCP3900 traffic to the inspection engine which is directly connected to F5 on a different segment. I have 2 inspection engines so I want to load balance the TCP3900 traffic.. When this traffic is inspected I want to receive this TCP 3900 traffic from a different segment on LTM and re route to final destination...

 

 

Should I create a regular TCP profile like the following or should I try iRules? What do you recommend?

 

 

 

virtual test_tcp_3900 {

 

destination 0.0.0.0:3900

 

ip protocol tcp

 

profile fastL4

 

pool test_tcp_3900

 

}

 

pool test_tcp_3900 {

 

monitor all tcp

 

member 10.1.1.1:3900

 

member 10.1.1.2:3900

 

}

 

 

Thank you for any leads.