bigip as FW

As Hamish said, LTM is an ICSA certified firewall in 11.x:

 

 

http://www.f5.com/pdf/solution-profiles/big-ip-ltm-firewall-security-sp.pdf

 

 

I'd actually suggest using virtual servers to limit access through LTM. With a virtual server, you can enable it on specific ingress VLAN(s). If you need to do more specific source based ACLs, you can use iRules on the virtual servers. Virtual servers and optionally iRules should perform much more efficiently than using packet filters as the latter are applied to all connections whereas a VS is by definition just one listener (IP:port combination). The packaging for this is going to get more refined as the ADC firewall matures.

 

 

Aaron