Allow an IP destination in Web Filter

I have IP destinations blocked in Web Filter, and this is causing problems with Xenserver updating. The updater uses an IP address, seen in the logs.
I added this IP to the Passed Sites list, but no joy. It's definitely Web Filter that's blocking it - when I turn Web Filter off, the updater is fine. Am I using the wrong procedure?