This is a continuation of the old ticket here, which was apparently closed and never resolved:
It seems this was reported again but mysteriously closed for some reason:
The short summary is that the firewall module cannot handle array of IP addresses for the 'source' or 'destination' properties. This would be extremely useful since you may wish to grant access to a list of network or machines using data from hiera.
This isn't the first time I've been involved with this issue, but this time I'm determined to resolve it one way or another, including writing the code myself. I welcome all comments on the status of this issue.