Difficulty question

I need to provide a way to control access from specific source networks through a virt to destination nodes in a pool and allow only specific ports to those nodes. Due to the way this particular application works there will be database servers required on the same subnet that support this application. The database servers are not allowed to be contacted by any system other then the application servers. Essentially I'm trying to build and "ACL" for specific host ips and ports that permits access to the app servers, but denies all other access to the database server. I was told the best way to do this is via iRules. How difficult is this to accompliah considering I'm a new guy to iRules?

 

 

 

Thanks for the input!