Firewall RemoteAddress fails test if CIDR notation is used

[globi84]

Hi

I use the NetworkingDSC Module in Version 7.2.0.0 and there is something wrong with RemoteAddress in CIDR format.

I use this configuration

Firewall FPS-SMB-In-TCP-NoScope {
        Name          = 'FPS-SMB-In-TCP-NoScope'
        Ensure        = 'Present'
        Enabled       = 'True'
        Profile       = 'Domain'
        RemoteAddress = '192.168.1.0/24'
    }

after pushing to the client, the test is always false and give me this message

[[Firewall]FPS-RPCSS-In-TCP-NoScope::[FirewallSMB]SMB-Firewall-Config] Test-RuleProperties: RemoteAddress property value '192.168.1.0/255.255.255.0' does not match desired state '192.168.1.0/24'.

When I use '192.168.1.0/255.255.255.0' for the remoteAddress everything works fine

is there bug with the module or do I something wrong?

regards

christian

[PlagueHO]

Hi @globi84 - thanks for raising this. We are using the New-NetFirewallRule and Set-NetFirewallRule cmdlet to create the rules and these do support CIDR bit number of bits notation in the format you show: See https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=win10-ps

But Get-NetFirewallAddressFilter always returns CIDR with subnet mask notation for the address filters no matter the input notation.

However, we actually have code to address this problem:
https://github.com/PowerShell/NetworkingDsc/blob/dev/DSCResources/MSFT_Firewall/MSFT_Firewall.psm1#L1204

But, there is a clear bug in it:

The above line:

if ($parameter.Type -eq 'IPArray')

Should be:

if ($parameter.Type -eq 'ArrayIP')

An easy fix but I'll improve the test automation as this shouldn't have got through.

Thanks again for raising this.

[globi84]

Hi PlagueHO

thanks for the fast response.

and the fast fix.

regards.