diff --git a/src/Network/Network/ChangeLog.md b/src/Network/Network/ChangeLog.md
index 8a1485c7efa0..ee57be53a14b 100644
--- a/src/Network/Network/ChangeLog.md
+++ b/src/Network/Network/ChangeLog.md
@@ -19,6 +19,7 @@
 --->
 
 ## Upcoming Release
+* Fixed a bug that does not enable to set Perform SNAT to Always
 * Fixed the incorrect type of `-TotalBytesPerSession` in `New-AzNetworkWatcherPacketCapture`
 
 ## Version 5.3.0
diff --git a/src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicy.cs b/src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicy.cs
index 30bb80c6b1d6..29a77027c8fe 100644
--- a/src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicy.cs
+++ b/src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicy.cs
@@ -122,7 +122,7 @@ private void ValidateMaskedIpAddress(string ipAddress)
             var splittedIp = split[0].Split('.');
             var ip = Int32.Parse(splittedIp[0]) << 24;
             ip += (Int32.Parse(splittedIp[1]) << 16) + (Int32.Parse(splittedIp[2]) << 8) + Int32.Parse(splittedIp[3]);
-            if (ip << bit != 0)
+            if ((ip << bit != 0) && (ip << bit != -1))
                 throw new AzPSArgumentException(String.Format(Resources.InvalidPrivateIPRangeUnmaskedBits, ipAddress), nameof(ipAddress), ErrorKind.UserError);
         }