Best Match Technology - SuperRanges:

ISCS allows nested IP addresses. When an IP address can belong to multiple sets, ISCS automatically determines whether to grant all possible rights or only the most specific rights according to the "Best Match" setting. No need to place just the right rule in just the right order and hope that it has not accidentally opened a security breach or created a denial of service. Here we see an IP address which lives on a network where we are doing NAT on the entire range (e.g., to resolve an IP address conflict) and has two "SuperRanges", i.e., IP address ranges in which it is nested.