The additional ACLs are hidden, being created on the fly.  This also prevents them from maxing out ACL limit and speeding up login process.  Ideally iSCSI should be on its own subnet, with dedicated NICs.  You can use the remote setup wizard to define what subnets are available for iSCSI use. It's a feature of HIT.  With MS iSCSI initiator if HIT didn't do that you would have to define each path connection manually for each volume.   With HIT you only need the one Discovery Entry, HIT does the rest.  
Could someone clarify something for me, do the access controls limit access to a volume from the specified IP address only, or does it allow access from any IP address from a computer that also includes the specified IP address... An example of what I mean... I have a volume1, which has a access control record of 192.168.1.10, and no others. I have a server with two isci connections to the switch, 192.168.1.10 and 192.168.1.11 When I look at the current connections to the volume it shows both the IP addresses as having connections - but I would like only one of the to connect.
Access controls and IP addressses