Azure Firewall PowerShell添加规则报错：找不到Add方法重载

我尝试在Azure Firewall中添加一条规则，已有Azure防火墙策略，其中创建了网络规则集合并添加了若干规则，希望在同一个网络规则集合中再添加一条规则，使用的脚本如下：

$rule = New-AzFirewallNetworkRule -Name "AllowAzureDevOps" -Description "Allow access to Azure Devops" -SourceAddress "10.0.0.0/16" -DestinationAddress AzureDevOps -DestinationPort 443 -Protocol TCP

$policy = Get-AzFirewallPolicy -Name "fw-policy" -ResourceGroupName "fw-rg"

$networkrulecollectiongroup = Get-AzFirewallPolicyRuleCollectionGroup -Name "DefaultNetworkRuleCollectionGroup" -ResourceGroupName "fw-rg" -AzureFirewallPolicyName "fw-pol"

$existingrulecollection = $networkrulecollectiongroup.Properties.RuleCollection | where {$_.Name -eq "NetworkRuleCollection"}

$existingrulecollection.Rules.Add($rule)

执行脚本中$existingrulecollection.Rules.Add($rule)语句时出现错误，报错信息如下：

PS C:\Users\mkumar480> $existingrulecollection.Rules.Add($rule)

找不到匹配参数计数为“1”的“Add”重载。位于 行:1 字符:1

• $existingrulecollection.Rules.Add($rule)

• + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest
  

问题原因 #

$existingrulecollection.Rules返回的是只读的固定大小集合，不支持直接调用Add方法添加元素，这就是报错的核心原因。

修正后的脚本 #

需要先将现有规则转换为可修改的列表，添加新规则后重新赋值，最后更新防火墙策略和规则集合组：

# 1. 创建新的网络规则
$rule = New-AzFirewallNetworkRule -Name "AllowAzureDevOps" -Description "Allow access to Azure Devops" -SourceAddress "10.0.0.0/16" -DestinationAddress AzureDevOps -DestinationPort 443 -Protocol TCP

# 2. 获取防火墙策略和规则集合组
$policy = Get-AzFirewallPolicy -Name "fw-policy" -ResourceGroupName "fw-rg"
$networkrulecollectiongroup = Get-AzFirewallPolicyRuleCollectionGroup -Name "DefaultNetworkRuleCollectionGroup" -ResourceGroupName "fw-rg" -AzureFirewallPolicyName "fw-pol"

# 3. 定位目标网络规则集合
$existingrulecollection = $networkrulecollectiongroup.Properties.RuleCollection | Where-Object {$_.Name -eq "NetworkRuleCollection"}

# 4. 将现有规则转为可修改的列表，添加新规则
$updatedRules = [System.Collections.Generic.List[Microsoft.Azure.Commands.Network.Models.PSAzureFirewallNetworkRule]]$existingrulecollection.Rules
$updatedRules.Add($rule)

# 5. 重新赋值规则集合，并更新规则集合组和防火墙策略
$existingrulecollection.Rules = $updatedRules
Set-AzFirewallPolicyRuleCollectionGroup -InputObject $networkrulecollectiongroup
Set-AzFirewallPolicy -InputObject $policy

内容的提问来源于stack exchange，提问作者Manish Kumar