If the ip policy covers the entire cidr, then cidrs will be empty.