Datagroup with address and value

you need to do in 2 steps:
1. determine which address range that the client ip address belongs to (using the above IP:addr .....; loop the address ranges until matching one)
2. check whether the ou matches the address range (using the data group)

awan_m I believe the following will work for you but I'm not 100% positive because I can't lab it. This is assuming you intend to send it to a specific pool but if not you can change the action in the if statement matching TEMP_OU to whatever action you would like.

when CLIENTSSL_CLIENTCERT priority 500 {

    set cert_subject [X509::subject [SSL::cert 0]]

    # release any stored data just in case
    HTTP::release
    # if there is still no cert after the SSL renegotiation kill the connection by sending a reset back to the client
    if { [SSL::cert count] < 1 } {
        reject
    }

}
 
when HTTP_REQUEST priority 500 {
 
    if { [class --match [getfield [IP::client_addr] "%" 1] equals ip_allow] } {

        set TEMP_OU [class --match -value [getfield [IP::client_addr] "%" 1] equals ip_allow]
        
        if { ${cert_subject} == ${TEMP_OU} } {
            pool <pool_name>
        }

    } else {
        reject
    }

}