how can I boundle two VS?

Yes, the session command works across all VS.

This is a nice rule and I think it will solve your problem well.

Couple of things though about your rule:

First is that you don't need to call IP::addr around IP::remote_addr or IP::local_addr. The IP::remote_addr and IP::local_addr commands will know format the address correctly.

Second, you have mismatched the key types between the two rules. In the ingress rule you are using "uie" but in the egress rule you are using "ssl". Probably a cut and paste error.

Third, you probably want to handle the case where the client is unknown. Maybe you can choose any router in this case. I added a default statement to the switch.

Anyway, here is a slightly more condensed version of your rules that doesn't even use any variables:

For ingress:

when CLIENT_ACCEPTED {
   session add srcaddr [IP::remote_addr] [LINK::lasthop] 180
}

For egress:

when CLIENT_ACCEPTED {
   switch [session lookup srcaddr [IP::local_addr]] {
   mac1 {pool router1}
   mac2 {pool router2}
   mac3 {pool router3}
   default {pool anyrouter}
   }
}

Again, this is a great rule!