AzSK_ARMTemplateChecker - VNET failure False positive about devopskit

[Khushboo-msft]

This will be fixed in our next release (going out this week).

[Khushboo-msft]

@samhodgkinson Could you please post the detailed error that you got. Azure_VNet_NetSec_Justify_IPForwarding_for_NICs is the control Id and not an error.

[samhodgkinson]

Your right; but the issue here is, IPForwarding is only enabled on the interface. I have scanned a template just containing VNET/Subnet/NSG. I should only get an IPForwarding alert/error when an interface is deployed and the enableIPForwarding parameter is set to $true.

Interface Schema
https://docs.microsoft.com/en-us/azure/templates/microsoft.network/2018-11-01/networkinterfaces

Network Schema
https://docs.microsoft.com/en-us/azure/templates/microsoft.network/2018-11-01/virtualnetworks

I will run the scan later and add a screen grab.

[patrick138]

same issue here:

ControlId : Azure_VNet_NetSec_Justify_IPForwarding_for_NICs
FeatureName : VirtualNetwork
Status : Failed
SupportedResources : Microsoft.Network/virtualNetworks , Microsoft.Network/networkInterfaces
Severity : High
PropertyPath : Not found
LineNumber : -1
CurrentValue :
ExpectedProperty : $.properties.enableIPForwarding
ExpectedValue : 'False'
ResourcePath : resources[0]
ResourceLineNumber : 86
Description : Use of IP Forwarding on any NIC in a virtual network should be scrutinized
FilePath : D:\a\1\s\src\Generic-VNet-and-SNet\vnet.json

[ashishrajsrivastava]

Yep getting the same false error for Vnet resource. If I add the expected property then it passes the azsk validation but then in deployment it will fail as its not a valid schema for Vnet.

##[error]BadRequest: { "error": { "code": "InvalidRequestFormat", "message": "Cannot parse the request.", "details": [ { "code": "InvalidJson", "message": "Could not find member 'enableIPForwarding' on object of type 'VirtualNetworkProperties'. Path 'properties.enableIPForwarding', line 1, position 115." } ] } } undefined