Change request wizards

Relevant for: All FireFlow users

This topic describes how to use various wizards in the change request forms to help you fid the values you want efficiently.

Choose Source/Destination wizards

The Choose Source and Choose Destination wizards help you specify a connection source or destination in a change request.

These wizards differ for IPv4 and IPv6 traffic, and may differ further, depending on your system configuration.

In your change request form, do the following:

  1. In the Source or Destination field, click .

    The wizard opens, displaying the Network Objects tab.

    For example:

    Tip: For Panorama devices, you can find URL Categories in the Network Objects list and use them as destination.

  2. Do one of the following:

    Select from a list of device objects or suggestions

    Do the following:

    1. Click the Network Objects tab.

    2. In the dropdown menu, select the type of network objects you'd like to view.

      To search, enter any part of the source/destination's name in the search field (case insensitive).

      All objects containing the string you entered are listed below the search.

    3. Select an item from the list of suggestions or device objects listed.
    Enter a specific value

    Do the following:

    1. Click the IP Address tab.
    2. Enter the IP address, IP range, CIDR, or Netmask value you want to use as the source/destination.
  3. Click OK.

If you entered a value in the IP Address tab, the wizard validates the entered value.

The selected source/destination is displayed in the Source or Destination field. For example, if you selected my computer, your computer's IP address is displayed.

In your change request form, do the following:

  1. Double-click in the Source or Destination field.

    The Choose Source Wizard or Choose Destination Wizard opens displaying the Suggested tab.

  2. Do one of the following:

    Select from a list of device objects or suggestions

    Do the following:

    • To search for a source/destination, in the Find field, enter any part of the source/destination's name (case-insensitive).
    • In the Select list, select the item you want to use as the source/destination.
    Enter a specific value

    Do the following:

    1. Click the IP tab.

    2. Do one of the following:

      Specify an IP address. Click IP and enter your IP address.

      Specify an IP range. Click IP Range and enter your IP range.

      Specify a network. Click CIDR and enter your network value.

      Specify any IP address. Click Any. This specifies an IP range of 0.0.0.0-255.255.255.255.
    Select from all device objects in AFA

    Do the following:

    1. Click the Device Object tab.

    2. To search for a device object, do the following:

      • In the Search dropdown list, select the device in which the object is located.
      • In the For field, enter any part of the object's name.

      The Select list displays all source/destinations containing the string you entered.

      To navigate between search result pages enter the page number you want to jump to in the Page field.

    3. In the Select list, select the desired device object.
  3. Click OK.

If you entered a value in the IP tab, the wizard validates the entered value.

The selected source/destination is displayed in the Source or Destination field. For example, if you selected my computer, your computer's IP address is displayed.

Choose Service wizard

The Choose Service wizard helps you specify a connection service in a change request.

These wizards differ for IPv4 and IPv6 traffic, and may differ further, depending on your system configuration.

In your change request form, do the following:

  1. In the Service field, click .

    The Choose Service Wizard opens, displaying the Service Objects tab and common service objects.

  2. Do one of the following:

    Select the service from a list of services

    Do the following:

    1. In the dropdown menu, select the type of service you want to view.

      By default, only common service objects are displayed.

    2. To search for a service object, enter any part of the object's name in the search field (case insensitive).

    3. Select the service object you want to use from the list displayed.
    Specify a custom service

    Do the following:

    1. Click the Services tab.

    2. Enter the service in one of the following formats:

      protocol/port, to indicate a single service.

      protocol/*, to indicate any port for the specified protocol

      protocol/port1-port2, to indicate a range of ports for a specific protocol

      *, to indicate "any" service
  3. Click OK.

If you entered a custom service, the wizard validates the entered value. The selected service or appears in the Service field.

In your change request form, do the following:

  1. Double-click in the Service field.

    The Choose Service Wizard opens displaying the Common tab.

  2. Do one of the following:

    Select the service from a list of services defined in AFA

    Do the following:

    • To search for an service, in the Find field, enter any part of the object's name in the search field (case insensitive).

    • In the Select list, select the service you want to use.
    Specify a custom service

    Do the following:

    1. Click the Other tab.

    2. In the Protocol area, select a specific protocol, or select Any.

    3. In the Port area, do one of the following:

      Select Single to specify a single destination port. Enter the port number.

      Select Range to specify a destination port range. Enter the port range.

      Select Any to specify any destination port.
    Select a service from a list of services defined on devices

    Do the following:

    1. Click the Device Service tab.
    2. In the Search area, select a device from the dropdown list.
    3. To search for a specific service defined on the device, in the For field, enter any part of the service's name (case-insensitive), and then click Go.
    4. In the Select list, select the desired service.

    Note: This feature is only supported for service's whose protocol is TCP, UDP, or ICMP. If a service is selected with another protocol, the change request will not open.

  3. Click OK.

If you entered a port number or range, the wizard validates the entered value. The selected service appears in the Service field.

Choose Application wizard

The Choose Application wizard helps you define an application for your change request.

This wizard appears depending on your system configuration, and only when there are Palo Alto devices defined in AFA.

For more details, see Enable / disable user and network application awareness

Do the following:

  1. In your change request form, in the Application field, click .

    The Application wizard is displayed.

  2. Select the application you want to use from the list of items displayed.

    Filter the items displayed by doing any of the following:

    • In the dropdown menu, select the device or device group on which the application is defined.
    • Search for an application by entering any part of the application's name in the field (case-insensitive).
  3. Click OK.

The application appears in the Application field.

Choose User Group wizard

The Choose UserGroup wizard helps you select a user group from all groups in a device's security policy, and is available for Web Filtering requests only.

Do the following:

  1. In your change request form, double-click in the User Group field.

    The Choose User Group Wizard opens.

  2. In the Search field, select the desired device.

    Note: This field displays only Symantec Blue CoatClosed As of A32.20 AlgoSec will no longer support adding new Symantec Blue Coat devices. Existing deployed Blue Coat devices will still be functional. device names.

    (Optional) To search for a user group, in the For field, type any part of the user group's name, and click Go. To navigate between search result pages, in the Page field, type the desired page number, then press Enter.

  3. In the Select list, select the desired user group.
  4. Click OK.

The selected user group is displayed in the User Group field.

Choose Category wizard

The Choose Category Wizard enables you to select a Web filtering category by selecting the category from a list of all categories that exist on a device.

Do the following:

  1. In your change request form, double-click in the Category field.

    The Choose Category Wizard opens.

  2. In the Search field, select the desired device.

    Note: This field displays only Symantec Blue CoatClosed As of A32.20 AlgoSec will no longer support adding new Symantec Blue Coat devices. Existing deployed Blue Coat devices will still be functional. device names.

    (Optional) To search for a category group, in the For field, type any part of the category's name, and click Go. To navigate between search result pages, in the Page field, type the desired page number, then press Enter.

  3. In the Select list, select the desired category.
  4. Click OK.

The selected category is displayed in the Category field.

Select Devices wizard

The Select Devices wizard enables you to quickly and easily select a single device or multiple devices.

Note: For more details, see Amazon Web Services and Microsoft Azure "Devices".

Do the following:

  1. Click in a field to select a device.

    The Select Devices wizard appears.

  2. Select a device by doing one of the following:

    • Click a device. Click the arrows at the bottom of the dialog to page through the list to find the one you want.

    • Search for a device. Do the following:

      1. In the Filter By dropdown, select the filter criteria you want to use.

        The following fields are available for filtering in the device selection wizard:

        Name and Policy

        Filter by both the device name and policy name.

        Name

        Filter by the device name.

        Policy

        Filter by the policy name.

        Brand

        Filter by the brand name.

        Selected

        Show only selected devices.

      2. In the textbox, enter your search criteria. The filter runs as you enter text.

        Click the arrow buttons at the bottom of the dialog to page through the list. Click a device to select it.

        Tip: Select all filtered devices by selecting the checkbox to the left of the Brand column. This is only supported for scenarios when multiple device selection is supported.

  3. To remove a device from the selected devices, click x.

  4. Click outside of the wizard to add the selected devices to the field.

    The selected devices are added to the field.

FireFlow handles Amazon Web Services (AWS) and Microsoft Azure "devices" as follows:

  • The "device" will always be the security "security set". A security set is a group of instances/VMs with the exact same security group(s) and network ACLs applied to them. Therefore, every instance/VM in a security set has identical security policies.

  • When modifying traffic for a security set, FireFlow automatically selects the optimal security group to modify in Initial Planning. The security group is selected based on rule capacity and the lowest number of affected instances/VMs.

    In Initial Planning, you can manually change the security group to modify, just like you can manually change which devices are relevant to modify for a change request. For more details, see Initial planning.