mitigation of brute force attacks using ASM for lync autodiscover

You might be able to do this, but the general consensus from most of my colleagues is that this is generally a bad idea. Lync is only partially HTTP and the ASM will simply refuse to pass any traffic that is not RFC compliant HTTP traffic. You might be able to protect the authentication, but you will still need an iRule to disconnect the ASM once that's done.

Also be aware that our Brute Force protection protects a specific URL, so you will need to know which page Lync is trying to hit for authentication.