Custom IPS Signatures

Hi everyone,

unfortunately I was not able to find a proper answer to this anywhere. I want to create custom IPS signatures specifically for known bad hosts, so I will receive a mail alert via the notification system. My current settings for one such signature would be as follows:

Name: Bad Host
Protocol: TCP
Custom rule: dstaddr:123.123.123.1;
Severity: Major
Recommended action: Allow packet

Since I to not want to add a single host but multiple ranges I was looking for a way to add a network a la dstnet. Could not find anything like that in the help files. So I tried the following:

Custom rule: dstaddr:123.123.123.1-4;
Custom rule: dstaddr:123.123.123.1-123.123.123.4;
Custom rule: dstnet:123.123.123.0/24; 
Custom rule: dstaddr:123.123.123.0/24; 
Custom rule: dstaddr:123.123.123.1;dstaddr:123.123.123.2;dstaddr:123.123.123.3;
Custom rule: dstaddr:123.123.123.1,dstaddr:123.123.123.2;

Pretty much tried every permutation I could think of, but it always says: IPS custom rule is not valid.

Ok, I though, I guess I have to add an absurd amount of custom signature objects via the API... But looking at the help files, I find the following:

"When a new custom IPS signature is added, the IPS engine is reconfigured without any interruption to service, provided there is enough RAM free for the reconfiguration to succeed. For XG firewalls with a low amount of free RAM available, the IPS engine will restart, causing a small disruption in service."

Since I would import over 2000 objects, I guess that would be pretty risky? Very difficult to assess. Apart from the fact that I would much rather prefer one object for one range.

Can anybody help here?

Cheers