SharePoint Extranet configuration

Question

We are in process of building out an Extranet for our Internal SharePoint environment primarily targeting External Partners (Non domain users) for now. We have few specific requirements  for the scenario which includes setting 2-Factor authentication,
routing internal users to WFE's and external via a Reverse Proxy. We are considering to use ACS/WAAD to hold external user related credentials in cloud and use proxy and ADFS to relay information to ACS for authentication and utilize built-in 2-Factor authentication
offered by AAD-Premier option. My questions are more on the implementation here:-
1. What Reverse Proxy servers might work along with ACS (Azure Control Service) -UAG seems deprecated and i'm not too sure about F5 compatibility here
2. We plan to follow edge topology (keep all SP servers internal) and maintain a proxy server in DMZ to perform pre-auth and then relay information to WFE's after authentication. Do you see any challenges in this scenario?
3. I assume we need to open up TCP 443 only on my perimeter firewall and probably do SSL termination at Reverse Proxy and relay information via port 80 to internal servers. Do you see any issues in this scenario?
4. I'm wondering about setting trust in this scenario. Do we need to setup one-way trust between AAD on cloud and our Internal Corp ad. Please share you thoughts in regards to azure ad and internal SharePoint in terms of setting up trust
We don't want to consider split or perimeter topologies as this increases upkeep and also adds up the server as well. 
Thanks in advance!

Answer 1

1. Windows Server 2012's Web Application Proxy role is the successor to the reverse proxy functionality of ISA/TMG/UAG. There are other third party applications and devices that can also be used. Some F5 devices do have this capability.
2. Usually organizations I work with have a security policy that says the external user's connection must terminate on a machine in the DMZ. In this case they would expect SharePoint WFE servers to exist in the DMZ while application servers and database
servers can exist on the LAN. Some organizations are challenged by the reverse proxy world view and don't consider this the end point. What you are asking will work if you're OK with this arrangement.
3. If you're terminating SSL at the reverse proxy then any traffic between it and your SharePoint servers will be unencrypted. Depending on the types of content you are storing in SharePoint this may not be acceptable to your organization. From a technical
perspecitve, if external users are using an https:// URL and internal users are using an http:// URL it could get confusing. You should redirect http to https on the reverse proxy and if possible either router internal users through it or have them use SSL
via some other method.
4. A typical resource domain that was built in your DMZ would trust your internal domain with a one-way trust. This would allow your internal users to authenticate on the servers in the resource domain and not vice versa. If you're building the SharePoint
farm internally and wanting to trust an external authentication provider, this can be a security risk. To be honest I'm not super familiar with the Azure AD options available to make any recommendation.
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights