Currently single port in range is mapped to single classify session.
If both source and destination ranges are specified, then classify session needs to be created for every <src,dst> pair, which means O(n^2) complexity both in memory and number of requests.

Ultimate solution would require improving classifier API to accept port ranges or changing other "policy" APIs to fully support L2 and L3 rules. Until then, some improvements are possible:

• special handling for ranges that can be represented by single mask
• try to translate number range into set of masks (n -> lg( n ) ?)