APM /my.policy and AFM

working with a simple APM policy on a virtual server (LTM+APM mode) with a logon VPE and not much else.   once i enable AFM and configure it in firewall mode (so deny default) this doesnt work a...