Production perspective - Design - Router service - loadbalancer - WAF

Issue

• According to the following link https://docs.openshift.com/enterprise/3.0/admin_guide/high_availability.html I need more precisions

• For our production perspective,
  OSE3 public domain name : cloudapps.example.com

• internet flows vers www.client.com -> WAF (BigIP) -> OSE3-Routers services -> OSE3 application

• internet flows vers (OSE GUI Management Console / ssh / oc commands / git push (https://admin.cloudapps.example.com) -> WAF (BigIP) -> OSE3.master nodes

• From the previous flows, because we need to use a Big IP F5-WAF, (but without BigIP Loadbalancer mechanism), should I have a publicIP address on each OSE3's router service ? it isn't necessary right ?

• In case of ha-cache=geo : https://docs.openshift.com/enterprise/3.0/admin_guide/high_availability.html#configuring-a-highly-available-routing-service :
  You don't see any drawbacks in order to have a public PaaS but throw a WAF which load-balanced to a set of VIPs attached to router services.

• How to use a different partition other than /Common for F5 ?