Ip Restrict then client cert check

Setting the client cert mode to request is only useful if the iRule or the web application validates the client cert. If you want LTM to do this using the client SSL profile it must be set to require. If you have a case open with F5 Support, you could ask them to help you capture a tcpdump and use ssldump to troubleshoot the failure. You might also be able to get some relevant info from the /var/log/ltm log file (somewhat doubtful on this though).

 

 

If that turns into a dead end, you could use a more complicated iRule which dynamically requests and validates a client cert based on the client IP address.

 

 

Aaron