Network access connection rejected by ACL is completing 3-way handshake?

Cut and paste in case that link breaks in the future:

This vip is created when you provision APM, it's part of 3 that handle Network Access traffic from a "connectivity profile", which is basically a special tunnel type of network interface. It's used as the forwarding virtual server for Network Access to process APM ACLs. The vips can be overridden by setting a higher-specificity (source or dest IP) vip on the connectivity profile vlan.

_tmm_apm_fwd_vip_http: This vip catches the HTTP traffic on port 80 and applies L7 and L4 ACLs.

_tmm_apm_fwd_vip: This vip catches everything besides port 80 and applies L4 ACLs.

The reason these are in there is that when a new network flow ingresses to BIG-IP, it must consult the list of virtual servers to determine how to handle the traffic. If a new flow doesn't match any virtual server listeners, it's dropped.

I'm not sure exactly what information you're looking for, but that's basically what it is.