How to create OS X Server Admin firewall rules using ip address groups by command line?
After 12 hours of searching and and not finding any example for ipfilter:ipAddressGroupsWithRules this https://help.apple.com/advancedserveradmin/mac/10.7/#apdA0111C46-F018-4C2C-B8D1-EDAEF73AC27E brought a helpful insight.

The only thing that need to be changed to create a new rule, and not update an existing one, is a first line that creates the rule. For example:

ipfilter:ipAddressGroupsWithRules:_array_id:11-net = create
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:addresses:_array_index:0 = "11.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:name = "11-net"


Now the output of $ sudo serveradmin settings &lt; 10-net.txt is no longer:

ipfilter:ipAddressGroupsWithRules = _empty_array


but:

ipfilter:ipAddressGroupsWithRules:_array_id:11-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:addresses:_array_index:0 = "11.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:rules = _empty_array
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:name = "11-net"


Which is the synonym for that entering the new setting succeeded.