Change fastL4 profile in iRule

no, you can't change the L4 profiles in stream. What you could do is set up three vips, one front-end vip and two back-end vips, setting the front-end and one back-end to indefinite, then the other back-end to a limited timeout, and use the front-end vip to switch the traffic. Still has the risk of port exhaustion if you get flood attacked on the front-end, but you could add policing logic into your front-end iRule for the connections not specifically allowed for indefinite timeouts.