Thank you very much.

On a related note - have you ever tried listener policies to achieve the same effect? Better or worse than overall ACL?

ACLs needs to be on a src --> dest IP basis.

Listen or Responder policy targets anything passing through it. For e.g.

Create these polices:

> add responder policy "DropEverything" TRUE DROP
> add responder policy "AllowCertainIPs" q/CLIENT.IP.SRC.EQ(1.2.3.4) || CLIENT.IP.SRC.EQ(4.3.2.1)/ NOOP
 
Then bind these two responder policies to your vServer(s) that you want to lock down, with the 'DropEverything' policy being at a lower priority (i.e. bigger priority number) than the 'AllowCertainIPs' policy.

It tends to be similar goals but normally if src and dest specific, acl can be consider otherwise the policies will be straightforward. Performance should not be an issue as the consideration is easier. Actually processing is faster for the policy compared to acl typically due to the "lesser" field to inspect or peek the traffic packet.