iRule for redirecting 128bit RC4-md5 and 128bit RC4-SHA to webpage

An HTTP_REQUEST does in fact come after the TCP and SSL handshakes, and the SSL::cipher command is only going to return the chosen cipher AFTER the SSL handshake, which means the command is only valid in SSL event and above. If you're looking at the SSL handshake in the network capture, you're going to see the client present a list of supported ciphers, one of which will invariably be RC4-MD5. The BIG-IP, however, will never choose that cipher unless you've specifically allowed it in your client SSL profile.

If you're looking to reject any browser that presents RC4-MD5 as a supported cipher, then you're most likely going to reject EVERY browser. I also tested your cipher string, and every browser on a Win7x64 system negotiated RC4-MD5.