ACL and SSF

Hi,

I forced encryption with olcSecurity but some of our applications do not support ldaps etc. Now I disabled globally the security and wanted to do it with ACLs to force all clients with encryption except for the ip addresses from those application servers. For this I thought it would work to add the first ACL line like this: {0}to * by ssf=256 auth by peername.ip=172.16.122.210 auth {1}.... {2}... .... But this doesn't seem to work.... Can somebody tell me if there is an error in reasoning or how to solve this approach?

/thx,chris