Allowing TCP inspection on a L3 Forwarding virtual server

Essentially forwarding VS's are for forwarding traffic to 1 place. (As a Router or bridge)

The slightly longer answer is that the forwarding virtual servers are specialised to just send traffic to a single place. It removes the ability to do certain things to them. e.g. destination address translation. Plus they don't have pools.

They also come in two flavours. L2 (Which is more like bridging) or L3 (Which is the equivalent of routing)

See https://support.f5.com/csp/article/K7595 and https://support.f5.com/csp/article/K14163

If you want to do things like TCP::collect then use a standard VS.

I don't believe you can change the VS type via an iRule... That doesn't make sense to me...