ISCS allows nested IP addresses. When an IP address
can belong to multiple sets, ISCS automatically determines whether to
grant all possible rights or only the most specific rights according
to the "Best Match" setting. No need to place just the
right rule in just the right order and hope that it has not
accidentally opened a security breach or created a denial of service.
Here we see an IP address which lives on a network where we are doing
NAT on the entire range (e.g., to resolve an IP address conflict) and
has two "SubRanges", i.e., IP address ranges which are
nested in it.