Redirection of the URL based on Source Segment

You should be able to do an iRule for that pretty straight forward.

Default pool for each VS should be it's matching pool. (HTTPS->HTTPS, HTTP->HTTP).

A simple lookup like this will redirect anything that doesn't existing in a data group (defined as an 'address' type) to the internet encrypted side.

when HTTP_REQUEST {
   if { ! [class match [IP::client_addr] equals internal_subnets] } {
      HTTP::redirect "https://www.test.com[HTTP::uri]"
      }
}