SSL mutual authentication against the pool

The point is, at the moment that you need to make an SSL decision, whether or not to require a client certificate, you haven't yet decrypted the application layer (HTTP), so you don't have access to the URL. iRule events work just like the OSI model. So at layer 6, you have access to all of the information available at layers 6 and below, which would include ClientHello SNI, ports, IP addresses, etc.

So you could make an SSL handshake decision based on the source or destination address, or the SNI in the client's ClientHello message. Or, you could direct all traffic to your regular VIP with the above iRule, and then redirect requests to a specific URL to another VIP that does mutual authentication.

when HTTP_REQUEST { 
    switch -glob [string tolower [HTTP::uri]] { 
        "/ABC" { 
            pool ABC 
            HTTP::uri [string range [HTTP::uri] [string first "/" [HTTP::uri] 1] end] 
        } 
        "/DEF" { 
            pool DEF 
            HTTP::uri [string range [HTTP::uri] [string first "/" [HTTP::uri] 1] end] 
        } 
        "/GHI*" { 
            HTTP::redirect "https://mutual-auth-vip.domain.com"
        }
    }
}