I have always used a Rewrite policy to insert the Strict transport security header works fine newer versions can do it directly on the SSL profile. My rewrite policy expression is true and the action is set to insert http header strict-transport security with max age value. The rewrite policy is bound to my NS GW vserver