What would the impact be if we place an web application firewall in front of the cluster active gates?
This depends on the application firewall configuration and your environment. The application firewall must not change the URL path at all. You can do inspection/ssl termination on the firewall without any problems. For sanity reasons, I would highly not recommend modifying any HTTP response codes (I've seen this at one customer and it was a mess to debug in case of issues). Basically, if you are just passing the communication, it is going to be fine.
