Most of the LDAP settings use semicolon as the separator character. But NTLM SSO subnet setting uses comma instead and this is not specified anywhere. So people try to use semicolon and it doesn't work.

The attached patch adds a small not to the setting help text stating how to separate multiple subnets.

Saludos.
Iñaki.