Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Invoke-IcingaCheckFirewall reports NotConfigured on Windows Server 2025 with GPO-managed firewall

Aperta Adatta ai principianti
  • Qualcosa non va?
#480 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
powershell
Ambito
observability-sre

Direzione di ricerca

Inizia con Invoke-IcingaCheckFirewall ed esamina la chiamata a Get-NetFirewallProfile mostrata nell’issue. Confronta il policy store predefinito con ActiveStore su un sistema Windows Server 2025 gestito tramite GPO. Il lavoro è completato quando il check valuta lo stato effettivo del profilo e restituisce OK quando Domain, Private e Public sono abilitati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

Invoke-IcingaCheckFirewall reports a critical state on Windows Server 2025 when the Windows Firewall is managed by Group Policy.

The check reports all firewall profiles as NotConfigured, although the effective firewall state is enabled for Domain, Private and Public profiles.

The issue appears to be related to the plugin using Get-NetFirewallProfile without specifying -PolicyStore ActiveStore.

On the affected system, the default policy store returns NotConfigured, while the effective active policy store returns True.

To Reproduce

  1. Install Icinga for Windows on a Windows Server 2025 system with Windows Firewall managed through Group Policy.

  2. Verify the default firewall profile state:

Get-NetFirewallProfile | Select-Object Name, Enabled

Output:

Name    Enabled
----    -------
Domain  NotConfigured
Private NotConfigured
Public  NotConfigured
  1. Verify the effective firewall profile state using the Active Policy Store:
Get-NetFirewallProfile -PolicyStore ActiveStore | Select-Object Name, Enabled

Output:

Name    Enabled
----    -------
Domain     True
Private    True
Public     True
  1. Verify the effective firewall state using netsh:
netsh advfirewall show allprofiles

Relevant output:

Domain Profile Settings:
State                                 ON

Private Profile Settings:
State                                 ON

Public Profile Settings:
State                                 ON
  1. Run the Icinga for Windows firewall check:
Import-Module icinga-powershell-framework
Import-Module icinga-powershell-plugins

Invoke-IcingaCheckFirewall `
    -FirewallProfile Domain,Private,Public `
    -Enabled `
    -Verbosity 3

Output:

[CRITICAL] Firewall profiles [CRITICAL] Firewall Profile Domain, Firewall Profile Private, Firewall Profile Public (All must be [OK])
\_ [CRITICAL] Firewall Profile Domain: Value NotConfigured is not matching threshold Enabled
\_ [CRITICAL] Firewall Profile Private: Value NotConfigured is not matching threshold Enabled
\_ [CRITICAL] Firewall Profile Public: Value NotConfigured is not matching threshold Enabled
  1. Inspect the implementation of the check:
(Get-Command Invoke-IcingaCheckFirewall).Definition

Relevant code:

$FirewallData = (Get-NetFirewallProfile -Name $singleprofile -ErrorAction SilentlyContinue);

$FirewallCheck = New-IcingaCheck `
    -Name "Firewall Profile $singleprofile" `
    -Value $FirewallData.Enabled

The check currently reads the default policy store, which returns NotConfigured on Windows Server 2025 systems where Windows Firewall is managed through Group Policy.

The effective firewall state is available through:

Get-NetFirewallProfile -PolicyStore ActiveStore

which correctly returns:

Domain     True
Private    True
Public     True
Possible root cause

Invoke-IcingaCheckFirewall currently uses:

Get-NetFirewallProfile -Name $singleprofile

On Windows Server 2025 with GPO-managed firewall profiles this returns:

NotConfigured

while the effective state is available via:

Get-NetFirewallProfile -PolicyStore ActiveStore

which correctly returns:

True

for all enabled firewall profiles.

Expected behavior

The check should evaluate the effective firewall state.

On systems where the firewall is managed by Group Policy, the effective state can be retrieved with:

Get-NetFirewallProfile -PolicyStore ActiveStore

Expected result:

Domain  Enabled
Private Enabled
Public  Enabled

The check should return OK when the effective firewall state is enabled.

Your Environment

  • Version used (icinga2 --version):
    Icinga Master: r2.16.1-1
    Windows Agent: v2.16.1
    icinga-powershell-framework: 1.14.2
    icinga-powershell-plugins: 1.14.1

  • Operating System and version:
    Icinga Master: Debian 12
    Windows Server 2025 OsBuildNumber: 26100

Lingua principale
PowerShell
Stelle
55
Fork
31
Merge medio
4g 5h
PR unite (30g)
6

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Icinga/icinga-powershell-plugins

Tutte le issue di Icinga/icinga-powershell-plugins

Issue simili

Altre issue su Observability & SRE

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.