Change a deployed rule

Need another port, source or destination on a rule FireSight already deployed? Request a change instead of a new rule. A change updates the policies the rule already has, where they are, on the same firewalls, so the rulebase doesn't fill up with near-duplicates. It's approved like any request, and backing it out puts the previous version back.

Request a change

1. Open the deployed request under Changes, Rule requests.
2. Click Request a change. FireSight opens a draft change, prefilled with the rule's current traffic.
3. Add or remove Sources, Destinations or Destination ports, or change the protocol or logging. The Action stays as it is: to block traffic a rule allows (or the other way round), raise a new request.
4. Give it a Title and a Business justification. A change can't be submitted without a justification.
5. Under Where it changes, check the policies it will update, then confirm and submit as usual.

Only requesters can start a change, and only from a request that is Live.

What the change shows

The change's page starts with Change to and the request it changes, with a table of Now and After this change: added addresses and ports are highlighted, removed ones are struck through.

Each firewall card shows Updates a policy, the policy's ID and name, and where it is now. What deploying will do lists the objects to create and Update policy … where it is for each policy.

The live pre-check checks the changed rule where it sits in its policy set (Fortinet: policy package), against the rules around it.

Deploying and backing out

An implementer deploys an approved change as usual. FireSight updates each policy in place: same policy ID, same name, same position, same firewalls. On a standalone FortiGate the policy stays enabled while it's updated.

Each deployment records the policy as it was. Back out everything on the change restores that version.

The original request can't be backed out while a change of it is live: back out the change first, which returns the rule to the original version, then back out the original if you want the rule gone.

Versions

A request that has been changed shows Versions in its side panel: the original request and each change, with their status and ports. Further changes are made from the latest version; the original says which version is current and links to it.

Only one change of a rule can be open at a time. Finish, or cancel, the open one before starting another.

Things to know

• A change keeps the rule on the firewalls it's on now. If new addresses are reached through other firewalls, raise a new request for them.
• A change can't remove every source or destination of a policy. To remove the rule, back it out instead.
• If someone edits or deletes the policy outside FireSight after the change was planned, submitting is refused until the change is saved again.
• A change keeps the original's Remove after date. When it passes, the change is removed first, then the original.
• Requesters, approvers and implementers get the usual rule request emails.