LTM/AFM design when migrating from traditional FW platform

Hi,

I'm new to F5 and I'm supposed to be migrating an existing FWSM/ACE configuration to F5 LTM/AFM. I'm currently learning the ropes using a VE appliance and I'm wondering if someone can offer some guidance or tips on replicating a NAT/ACL environment on LTM with AFM.

Is it possible to create NATs and allow inbound traffic (from low security zone like the internet) without using virtual-servers? Or does everything that needs inbound connectivity require a virtual-server?

Thanks