How permit part of the url access?

HTTP::redirect "http://static.bla.com/403.htm" target="_blank" rel="nofollow">http://static.bla.com/403.htm"

This won't work as you're probably expecting, as it's HTML you're trying to send back to the client. If you send a 302 redirect with a Location header of http://static.bla.com/403.htm, the client will make a new GET request to that URL using the same window. If you want to send back a page with HTML including a link to the page, you could use HTTP::respond (Click Here) instead.

If you configure a default pool on the VIP, you could use a simplified version of CB's switch based iRule to check the requested URI and client IP for requested paths of exactly /Claytonkb:

when HTTP_REQUEST {

    Check the requested path set to lowercase
   switch [string tolower [HTTP::path]] {
      "/claytonkb" {
          Requested path was exactly /claytonkb, so check if the client IP is not in the datagroup
         if {not [matchclass [IP::client_addr] equals $::Calyton_allowed_IPs] }{
            log local0. "[IP::client_addr]:[TCP::client_port]: Redirecting request from [HTTP::uri]"
            HTTP::redirect "http://static.bla.com/403.htm"
         }
      }
   }
}

If you have other paths you want to check for, you could add them to the switch statement.

Aaron