Ip Restrict then client cert check

Can you remove the HTTP_REQUEST event and retest? Also, you only need one set of square braces around matchclass. It shouldn't matter which client SSL profile you specify in the VIP config as the iRule will set it based on the client IP address check.

 
 when CLIENT_ACCEPTED {  
    if { [matchclass [IP::client_addr] equals $::Test_IPs]} {  
      SSL::profile NoBrowserCert  
    } else {  
      SSL::profile BrowserCert  
    }  
  }  
 

If this doesn't work, can you clarify what happens when testing from a client in the Test_IPs class and one not in the class?

Thanks,

Aaron