Getting the Scope of a firewall rule

If I use

q: (names of (rules of firewall) whose ((name of it) as string Starts with "Remote Desktop" and currently active of it and remote addresses string of it is  "128.blah.blah.blah/255/255/252.0"))

It returns the rule names…

I want to basically reverse that action and look at the scope or Remote address of a firewall rule that starts with “Remote Desktop”… So I tried both

q: (remote addresses strings of ((rules of firewall)) whose ((name of it)) as string starts with  "Remote Desktop")

and

q:( scope of (rules of firewall) whose ((name of it)) as string Starts with "Remote Desktop")

Both returned a boolean expression is required

Sorry if this aoppears simple to resolve…
Thanks

It’s complaining about the part in parenthesis after ‘whose’ which needs to be a boolean stmt. You just closed your parens a little early, so change it to:

q: (remote addresses strings of (rules of firewall) whose (name of it as string starts with "Remote Desktop"))

or with less parens:

q: remote addresses strings of rules whose (name of it as string starts with "Remote Desktop") of firewall

There is no ‘scope’ property for firewall rules, but you can do ‘local addresses strings’ also.

Thanks Steve… That’s Perfect… Much appreciated…

I find it is best to start with the raw data, then filter down from there:

(remote addresses string of it | "<unknown>", name of it | "<unknown>") of rules of firewall

then:

(remote addresses string of it | "<unknown>", name of it | "<unknown>") of rules whose(name of it starts with "Remote Desktop") of firewall

Don’t try to filter results until you are certain you have results to filter.