Passive FTP failing, F5 send TCP RST after receiving Entering Passive mode from server

Try creating a non-default ftp profile and allow ANY data port.

Per default, only port 20 is allowed:

    list ltm profile ftp /Common/ftp all-properties 
   ltm profile ftp /Common/ftp { 
       app-service none 
       defaults-from none    
       description none 
       inherit-parent-profile disabled 
       log-profile none 
       log-publisher none 
       partition Common 
       --> port ftp-data <-- 
       security disabled 
       translate-extended enabled 
    }

try using this instead:

ltm profile ftp ftp_dataport_any { 
    app-service none 
    defaults-from /Common/ftp 
    --> port any <-- 
} 

With this profile, you also should not need to enable the virtual on any port, but on the desired ftp-control port only (in your case 10021).

HTH Martin