We need to create an iRule that can verify client's certificate by checking the Subject line contains "CN=ABCD".

That looks good. Make sure to check that there is a cert before trying to parse it as you'll get a runtime error and TCP reset if you don't and the client doesn't present a client cert in the handshake.

when CLIENTSSL_CLIENTCERT {

if {[SSL::cert count] > 0}{
set cert [SSL::cert 0]
set subject [string tolower [X509::subject $cert]]
set clientIP [IP::client_addr]
if { $subject contains "cn=abcd.com" } {
pool abcd } {
log local0. "cert CN valid" }
else {
log $clientIP
log local0. "cert CN not valid"
reject
}
}
}

Aaron