Bypass APM on specific subnets

Try this:

when HTTP_REQUEST { 
    if { [IP::addr [IP::client_addr] equals 10.3.220.0/21] } {
        ACCESS::enable 
    } 
    elseif { [IP::addr [IP::client_addr] equals 10.0.0.0/8] or [IP::addr [IP::client_addr] equals 192.168.0.0/16] or [IP::addr [IP::client_addr] equals 172.16.0.0/12] } {
        ACCESS::disable
    }
}