A BIG-IP device is configured with both an internal external and two Corporate VLANs. The virtual server has SNAT enabled and is set to listen on all VLANs Auto Last Hop is disabled. The Corporate use

Disabling the server on the internal VLAN would prevent all internal users from accessing the virtual server, which is the opposite of the desired outcome for the 172.16.0.0/12 subnet.

The problem states that users from 10.0.0.0/24 can connect and traffic is seen, but users from 172.16.0.0/12 cannot connect. This strongly indicates that the BIG-IP system does not have a route back to the 172.16.0.0/12 subnet, preventing it from forwarding response traffic to those clients. Adding a static route for the 172.16.0.0/12 subnet, pointing to its next-hop gateway, will resolve this routing issue.

Changing the default route to point to an extra firewall is a general network configuration change and does not specifically address the lack of connectivity for a particular internal subnet like 172.16.0.0/12, especially since internet users can connect.

Modifying the default route of the servers to point to the BIG-IP device is typically done for server-side routing, but the issue described is client-side, where the BIG-IP cannot reach specific client subnets.