Approve and reject

Approvers hold the Team lead, Security or Change board role (administrators can decide any stage). Each request goes to one or more approval chains; within a chain, stages are decided in order. See Approval chains for how chains are set up.

Find what's waiting for you

• Changes, Approvals lists every request whose current stage you can decide, including emergency changes waiting for your review. The number next to the menu item shows how many requests await your approval.
• The Overview shows waiting for your approval with a Review link.

If nothing is waiting, the page says Nothing is waiting for you.

FireSight doesn't send email or chat messages about approvals. Check the Approvals page, or use your change process to tell approvers.

How a request is routed

When a request is submitted, FireSight works out its tracks, one per chain:

• each management domain (Fortinet: ADOM) the request changes uses the chain assigned to it, or the standard chain. Domains that share a chain share one track;
• every condition the request matches adds its chain, or adds its reason to a track already there.

Tracks run in parallel. The request is approved when every track has approved it, and one rejection on any track rejects it. The request's Approval panel shows each chain, why it applies (for example ADOM APAC or condition: Remote admin ports) and each stage.

The stages are copied onto the request when it is submitted, so later changes to a chain never alter requests already in flight.

Approve a stage

1. Open the request from Approvals.
2. Read the justification, the traced path, the targets and each pre-check. What deploying will do lists the exact steps.
3. Click Approve.
4. The dialog says which firewalls you are approving a policy on. If the pre-check found high-severity issues, it warns you: The pre-check found high-severity issues on at least one firewall. Read them before approving.
5. Add an optional Comment (optional) and click Approve stage.

If you can decide the current stage of several tracks, approving decides all of them at once (or only one, if each chain needs a different person; see below).

Reject a request

1. Click Reject.
2. Enter a Reason (at least 3 characters). The requester sees it and can edit and resubmit.
3. Click Reject request.

Rejecting marks every other pending stage as skipped and the request as Rejected. The requester must change it before it can be submitted again.

Who can decide a stage

You can decide a stage only if all of these are true:

• you hold the stage's role (Waiting on Team lead, for example), or you're an administrator;
• if the stage names approvers (named approvers only), you're one of them;
• you didn't request it (unless Allow self-approval is on);
• you haven't already approved an earlier stage of the same chain (unless Same approver for several stages is on);
• if Different people for each chain is on, you haven't approved it in another chain.

FireSight explains a refusal, for example requesters cannot decide on their own rules or you already approved an earlier stage of this chain. These options are under Settings reference.

The approval timeline

Each stage shows:

When no chain applies

A request is never approved by default. If no usable chain applies, submitting fails with no approval chain applies to this request; ask an administrator to check the chains.

Emergency changes

Emergency changes are approved by the emergency chain alone and reviewed afterwards. See Emergency changes.