Query on mtls handshake during SSL offloading from F5


Have enabled mtls “STRICT” policy across entire Mesh. I have a case, where we have SSL offload happening at F5(internal communication from onprem to cloud) level before it reaches istio Mesh.

OnpremService send request to F5.
F5 does SSL offloading
Istio IngressGateway receives request from F5

As per policy when mtls “strict” is enabled, then istio simply rejects incoming http request is what my understanding.
When Istio IngreessGateway receives the request with http from f5 and forwards it to SideCar proxy and then to app container, how does istio does the SSL handshake for service A <-> B communication happens inside a Mesh?

please assist on getting clarified on the flow.