Firepass with LTM without SSL offload

You cannot see the host name or URI without terminating the SSL. Well, technically you could see the host name in the Server Name Indicator of the CLIENTHELLO message if the client was TLS-capable, but that's probably not an answer here. You may simply need to terminate the SSL, inspect the URI, and then redirect to the other device using a different name. Or, you could put an LTM virtual server in front of both APM and FirePass, terminate the SSL there, and then forward the traffic to the external Firepass box, or internal layered APM VIP.