You have trusted clients and untrusted clients on the same subnets?
If not, consider using IP ranges for condition sets?
