18.8.5.1.1. Configuration 
MTLS for HFA is indirectly enabled or disabled via option Certificate
Verification Level in HG3500 WBM. This option is located in menu:
Configuration > Security > Signaling and Payload Encryption
(SPE) > SPE Security Setup > HFA/H.323 TLS Parameters.
In order to adjust settings single click on SPE Security Setup.
Figure 414. HFA SPE Configuration
When verification level is set to Trusted or Full, client
certificate is requested and verified during SSL/TLS handshake. Client
certificate must be signed by some trusted CA, whose public key certificate
must be present on CGW (more CA certificates can be present).