I have a question about the NSX-T DFW Applied to rules.

I case if I have in Groups ip address or IP Subnet, Applied To rule doesn't work. In the case if I create Groups as Membership Criteria or select virtual machine from members, Applied to works as it should.

Where is the problem and why does it not work if I have an IP address in the group.