VIP with multiple pools and TCP ports

The use of an iRule will be non-trivially slower than using separate Virtual Servers. Incidentally, if the pools all contain the same set of nodes and differ only by listening port, you could define a single Virtual Server and single pool, where all members (and the VS) use the wildcard port, and disable port translation.

Having said that, the use of a data-group will be faster than a

switch

 create ltm data-group internal dg-port-match type string records add \
    { 901 { data pool_901 } \
      902 { data pool_902 } \
      903 { data pool_903 } \
      ... }

In other words, the key is the VS port and the value is the pool. Then, the iRule is:

when CLIENT_ACCEPTED {
    set p [class lookup [TCP::local_port] dg-port-match]
    
    if { $p ne "" } {
        pool $p
    }
    else {
        log local0.warn "Invalid port connect attempt; port = ([TCP::local_port])"
        reject
    }
}

Strictly speaking, if no default pool is associated with the VS and it is of Standard or FastL4 type, the reject is implicit, so you can skip that if you don't wish to log (and, of course, it makes more sense to use High-Speed Logging rather than local logging for production).