Change default firewall policy for new Virtual Servers

The default behaviour you are talking about, is what we call ADC mode or Firewall mode.

In ADC mode the virtual server will allow traffic from the sources you define in the virtual server, and the vlan you specify there. If you don't restrict the source or vlan, basically everyone can access. If want to block something, you need a firewall rule for that.

In Firewall mode, you need to create firewall rules to allow that. Everything is blocked until you create rules to allow.

During the creating of the virtual server you can't specify the AFM policy, but you can apply that after the virtual server creation.