Approval chains

An approval chain is an ordered list of stages. Each management domain (Fortinet: ADOM) is approved by one chain, and conditions can add more. Only administrators manage chains, under Settings, Approval chains.

The list on the left has:

• the standard chains, with how many management domains and conditions use each (Not used yet if none), and + New chain;
• Emergency: the emergency chain, or + New emergency chain if there is none;
• Routing: ADOM assignments (which chain approves each domain) and Conditions;
• Recycle bin: Deleted chains, when there are any.

Chains that are switched off are tagged Off.

The standard chain

FireSight always has one standard chain, called Standard chain on a new installation, with three stages: Team lead review (Team lead), Security review (Security) and Change advisory board (Change board). It is used by every management domain that isn't assigned another chain, and as the fallback when a domain's own chain is off.

The standard chain can't be switched off or deleted. Change its stages instead, or assign domains to other chains.

Create a chain

1. Click + New chain.
2. Enter a Name (up to 100 characters, unique), such as PCI data owners, and an optional Description.
3. Set up the stages (see below).
4. Click Create chain.
5. Assign it to management domains under ADOM assignments, or use it in a condition.

Stages

Each stage has:

Click Add stage for more (up to 20). Click Save chain to save.

Changes apply to requests submitted from now on. Requests already submitted keep the approvers they started with.

Assign chains to management domains

Open ADOM assignments. For each management domain, choose the chain under Approved by:

• … (standard): the standard chain (the default);
• any other standard chain. One that is off shows (off: standard chain used).

A request goes to the chain of every domain it changes; domains that share a chain share one set of approvals. Offline snapshots have no approvers and aren't listed. The emergency chain can't be assigned to a domain.

The same assignment is shown read-only in the Approvers column of Settings, Connections, ADOMs and firewalls.

Switch a chain off

Any chain except the standard chain has an On / Off switch.

• A standard chain that is off: its domains use the standard chain instead, and conditions that add it are skipped. A request never goes without approvers.
• The emergency chain that is off: Nobody can submit or approve an emergency change until it's back on.

Switching off only affects requests submitted from then on, except for emergency changes as described in Emergency changes.

Delete and restore a chain

1. Open the chain and click Delete chain.
2. The dialog lists what happens: which domains go back to the standard chain, how many requests are waiting on it (they keep these approvers) and, for the emergency chain, that nobody can submit an emergency change until there is one again.
3. If conditions add this chain, tick Also delete the condition(s) that add it. You can't delete the chain otherwise.
4. Type the chain's name to confirm, and click Delete chain. Or click Switch it off instead, or Keep it.

Deleted chains move to Deleted chains, which shows when each was deleted and what restoring brings back:

• Restore puts it back with its stages, its conditions, and the domains that still use the standard chain.
• Remove for good deletes it permanently. It can't be restored after this; the audit log keeps the record.

A new chain can't take the name of a deleted chain: restore it, or choose another name.

The emergency chain

The emergency chain approves emergency changes on its own, so they can be deployed straight away. The normal chains then review the change after it is live. There can be only one emergency chain; FireSight creates Emergency change with one stage, Duty security approval (Security).

Requesters can only mark a change as an emergency when Allow emergency changes is on under Policies & schedules. See Emergency changes.

Approval rules

These settings change who may decide, under Settings, Policies & schedules, Approvals:

See Settings reference.