18.8.5.1.5. Full Level Features 
When MTLS is enabled on level Full, basic client certificate
verification scenario is the same as on level Trusted. Additionally,
X509v3 extensions of client certificate are examined during SSL/TLS handshake.
Certificate verification procedure fails, if any unknown critical extension
occurs, or if usage of known extensions (basicConstraints, keyUsage,
extendedKeyUsage and nsCertType) violates current standard.
Full client verification level also enables one to perform
Subject identity check of client based on SubjectAlternativeName or CommonName
present in certificate. Note, that identity check is enabled by default.
This behavior can be changed by checkbox:
Configuration > Security > Signaling and Payload Encryption
(SPE) > SPE Security Setup > HFA/H.323 TLS Parameters > Subject
name check.
Identity check attempts to lookup SubjectAlternativeName or CommonName
(respectively) via DNS and obtains IP address associated with this name.
If any address is found and the address matches real IP address of connected
client then identity check succeeds, handshake fails immediately otherwise.