Invert match in AFM policy

if you would like to change a single allowed address such as this one

1. accept all traffic to 10.1.1.1/32

you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

for example assuming the rest of the network is a 24 bit subnet mask,

1. drop/reject all traffic for 10.1.1.1/32
2. accept all traffic to 10.1.1.0/24

or vice-versa if you want to allow your specific ip address on a blocked subnet.