yep I have done that on my GSS, tcp probing answers configured as VIPs on the ports the VIP is listening on at the F5, in this case port 80. The thing I don't understand is the event here is CLIENT_ACCEPTED, doesn't that imply the F5 has to complete the 3 way handshake before the irule is evaluated? I do see when I telnet to the vip with the irules I mentioned above the connection is dropped right away, but that is after the initial handshake completes thus it's too late for the GSS to know better, it has already considered the keepalive passing. I have also tried reset and graceful on the GSS termination method, no dice.