Fix STATUS_FWP_INVALID_INTERVAL 0XC0220021

Got this error and it's stopping your firewall rule from applying? Don't panic — it's almost always a dumb typo in the time interval format. Let's get it working.

The Quick Fix

Open an elevated Command Prompt (right-click Run as administrator) and run this to see the broken rule:

netsh advfirewall firewall show rule name=all verbose

Look for any rule with a Local or Remote time interval that looks like 0:0:0 or something weird like 00:00:00. The culprit here is almost always a time interval set to 0 or left blank in a script or GUI tool. Windows expects a positive integer for seconds, minutes, hours, or days — not zero.

If you find one, delete it with:

netsh advfirewall firewall delete rule name="Your Rule Name"

Then recreate it with a proper interval. For example, to allow traffic for 1 hour:

netsh advfirewall firewall add rule name="Allow 1 Hour" dir=in action=allow localport=3389 protocol=tcp interval=3600

The interval is in seconds — 3600 seconds = 1 hour. Don't use 0. Don't skip it.

Why This Happens

STATUS_FWP_INVALID_INTERVAL means the Windows Filtering Platform got an interval value it can't parse. Valid intervals are positive integers (1 to 0xFFFFFFF). Zero is invalid. So is any negative number, or any string like "00:00:00" that looks like a time but isn't an integer.

This error pops up most often when you're scripting firewall rules with PowerShell or batch files, and you forget to set the interval properly. Or when a third-party tool exports a rule with a blank interval.

Less Common Variations

1. PowerShell New-NetFirewallRule

If you're using PowerShell, the parameter is -IdleTimeout, not -Interval. Some people mix them up. Correct usage:

New-NetFirewallRule -DisplayName "MyRule" -Direction Inbound -Action Allow -LocalPort 443 -Protocol TCP -IdleTimeout 3600

Again, value in seconds. No zero.

2. Group Policy or GPO

If you set a firewall rule through Group Policy with a time interval, check the GPO editor. The interval field expects seconds, not minutes or hours. I've seen admins put "60" thinking it's minutes — that's 60 seconds, not 60 minutes. Double-check your math.

3. Third-Party Firewall Tools

Tools like Windows Firewall Control or TinyWall sometimes export rules with malformed intervals. If you import a rule and get this error, open the exported XML and look for <internal:interval>. It should contain a positive integer. Fix the XML manually or recreate the rule.

Prevention for Next Time

Three things to avoid this:

Always use positive integers for intervals. Seconds only. No colons, no zeros, no blanks.
Test scripts in a VM first — especially if you're deploying to multiple machines. This error stops the whole rule, not just the interval part.
Check the Event Log — look under Applications and Services Logs > Microsoft > Windows > Filtering Platform for the exact rule name that failed. Saves you guessing.

That's it. Fix the interval, rule works. Took me way too long to learn this the first time.