Restrict FTP traffic on VIP to IP address or range

There is no limit or hard number of iRules that you can run on a BigIP. It all depends on the intensity of the iRules that you implement.

 

 

The 3600's are pretty beefy boxes, and this iRule running on 10 VIP's won't phase them at all. There are numerous posts on DevCentral for writing efficient iRules or how to test an iRule to see how much processing power it takes to run them, so if it is a concern I would suggest doing some additional research.

 

 

Should you run this on a firewall instead? That is actually a matter of preference. Both would / could solve your problem. I guess it could boil down to which one was easier to mantain or how much flexibility is required to add / remove things to the allow / deny list.