How to provide VS for separate access to nodes

If you don't want to do it for the subnet, you could create a host IP forwarding VS for each node permitting access based on a source network - however this wouldn't be the most scalable solution.

Eg:

ltm virtual fwd_vs {
  destination 10.0.0.1:0  
  ip-forward
  mask 255.255.255.255
  profiles {
    fastL4 {}
    }
  source 0.0.0.0/0
  vlans {
    external
    }
  vlans-enabled
  }

Alternatively you could also create a network forwarding VS and use the subnet mask to restrict access to a certain range of IP addresses