Client IP condition not working

I’m trying to refine some policies with client IP addresses, but it’s not behaving as expected.

I have a webui policy that I want applied for all IPs except, so I added this condition:

Client = -

But now the policy never works, regardless of the client IP.

Am I misunderstanding the field’s use?


I should also mention that I also used:

Client = !

Well, I got the policy to work, but I had to preceed the excluded IP with included IPs. Good thing I’m not including the world.