The Client Blocking Rules under common security controls on the LB allow an expiration date to be associated to each IP/range record. This ensures the IPs roll off the block list after some time which is ideal. The records in the IP Prefix Sets do not allow for this so it requires manual maintenance or automation to identify when they should roll off. This would be ideal when the IP Prefix Set is associated to a "Deny" security policy.