Approve planned changes

Relevant for: Privileged users

This topic describes the procedures you may perform during the a change request's Approve stage.

Note: At several points, you may need to notify requestors about updates made.

For details, see Manage requestor notifications.

Find affected rules

This procedure explains how information security users can find device rules that are affected by a change request.

This may be performed as part of the Plan or Approve stage, depending on whether the change request is for single or multiple devices.

Note: To determine a change request's stage, view the change request. The stage is indicated by the Change Request Lifecycle Status Bar. For details, see View change requests.

Do the following:

  1. View the change request. For details, see View change requests.

  2. Do one of the following:

    • For single device object change requests, at the top of the page, click Find Affected Rules.
    • For multi-device object change requests, click Find Affected Rules for every sub request.

    The Affected Rules page appears displaying the number of device rules affected, as well as the affected rules per object.

    Note: For Check Point devices, FireFlow finds affected rules on all devices where the object exists. Specifically, object change requests for objects defined on the CMA show affected rules on all policies of devices below that CMA, and object change requests for objects defined on the MDSM show affected rules on all policies of devices below any of the CMAs.

    For Multi Device Object Change requests, the Affected Rules area displays full details about the rules.

  3. To view the affected rules' details when using the single device object change workflow, in the Affected Rules area, click the Details link.

    A window opens displaying the rules' details.

    • Yellow highlighting indicates which objects contain the object(s) relevant to the change request.
    • Light-blue highlighting indicates where an object slated to be deleted will be replaced by "Any". Examine rules with objects highlighted in light-blue to prevent security holes.

    Note: Light-blue highlighting is only relevant when deleting objects from Check Point devices.

  4. In the Affected Rules page, click Next.

To continue with the change request, see Approve, reject, or return to planning.

Certify or plan traffic removal

Once you have received responses from the related change requestors, you must decide whether to certify the Allow traffic or plan its removal.

This topic describes how network operation users can certify or plan traffic removal for recertification requests in the Approve stage.

Note: To determine a change request's stage, view the change request. The stage is indicated by the Change Request Lifecycle Status Bar. For details, see View change requests.

Do one of the following:

Certify the Allow traffic if the related change requestors' responses indicate that the Allow traffic should not be removed.

  1. View the change request. For details, see View change requests.

  2. Click , and then click Traffic is Needed.

    A confirmation message appears.

  3. Click OK.

    The Certify Change Request page is displayed.

  4. Complete the fields as needed. For details, see Respond to change requests.

  5. Click Next.

The email message is sent to the requestor, the change request is resolved, and the HOME page appears.

Plan traffic removal when the related change requestors' responses indicate that the Allow traffic should be removed.

  1. View the change request. For details, see View change requests.

  2. Click , and then click Plan Removal.

    The Plan Removal page appears displaying a list of devices on which the traffic is allowed.

  3. Specify the devices from which the Allow traffic should be removed, by doing any of the following:

    • To select an individual device in the list, select the check box next to its name.
    • Click Check All to select all devices in the list.
    • Click Clear All to select none of the devices in the list.

    • To specify additional devices that are not listed, do the following:

      1. Click Select additional devices.

        The All Devices dialog box opens with a list of all devices in the FireFlow system.

      2. Select the check boxes next to the desired device(s).

      3. Click OK.

        The selected devices appear in the list of devices from which to remove the Allow traffic, with an asterisk next to their name.

      4. Click Next.

        The recertification request proceeds to the Implement stage.

A request is opened for each of the selected devices.

Perform a manual risk check

This section explains how information security users can perform a manual risk check for generic change requests in the Approve stage.

Note: To determine a change request's stage, view the change request. The stage is indicated by the Change Request Lifecycle Status Bar. For details, see View change requests.

After a generic change request has been created, it starts the Approve stage of the FireFlow change request lifecycle. In this stage, you perform a manual check for risks entailed in implementing the requested change.

You must then decide whether to return the change request to the Plan stage for further planning, reject and close the change request, or approve it.

Do the following:

  1. View the change request. For details, see View change requests.

  2. At the top of the page, click Manual Check.

    A confirmation message appears.

  3. Click OK.
  4. Examine the change request, and determine whether implementing it would involve risks.

Approve, reject, or return to planning

This topic explains network operation or information security users can approve, reject, or return a change request to the Plan stage.

Note: To determine a change request's stage, view the change request. The stage is indicated by the Change Request Lifecycle Status Bar. For details, see View change requests.

Request handling per request type

The following table describes how you might want to handle requests of different types at the Approve stage in your workflow.

Change request type Description

Object change requests, including multi-device

Traffic change requests with drop actions only

When working with an object change request or a traffic change request with only "Drop" action(s), once you have examined the affected rules results or notified requestors of related change requests, you must decide whether to:

  • Return the change request to the Plan stage for further planning
  • Reject and close the change request
  • Approve the change request
Traffic change requests with an allow action

When working with a traffic change request with an "Allow" action (with the exception of IPv6 traffic), you must examine the risk check results before you approve the change request.

Examining the risk check will:

  • Follow initial planning if the change request you are working with has only "Allow" actions
  • Follow notifying requestors of related change requests if the change request you are working with also has "Drop" action(s)

After you have examined the risks, you must decide whether to:

  • Return the change request to the Plan stage for further planning
  • Reject and close the change request
  • Approve the change request
IPv6 traffic change requests

When working with IPv6 traffic change requests you must decide whether to:

  • Reject and close the change request
  • Approve the change request
Rule removal requests

When working with a rule removal request, once you have received responses from the related change requestors, you must decide whether to:

  • Reject and close the change request
  • Approve the change request

Rule modification requests

When working with a rule modification request, you must first decide whether to modify the change request. If you decide to do so, you must examine the risk check results.

You must then decide whether to:

  • Reject and close the change request
  • Approve the change request

Web filtering change request

When working with a Web filtering change request, you must decide whether to:

  • Return the change request to the Plan stage
  • Approve the change request

Do any of the following:

This procedure describes how to modify a rule modification request.

  1. View the change request. For details, see View change requests.

  2. At the top of the page, click .

    The details of the rule modification request are displayed in an editable format.

  3. Modify the Source, Destination, and/or Service/Application fields as desired.
  4. Click Ok.

The change request is modified.

Note: The method FireFlow uses to choose devices to perform risk checks on requests and their devices or policies can be customized by an administrator. For more details, see Additional FireFlow parameters.

Do the following:

  1. View the change request. For details, see View change requests.

  2. If the risk check is not available, refresh the risk calculation by clicking Recalculate.

    Note: You will also want to recalculate the risk check in the following rare cases: if you edited the risk profile in AFA, the routing of the device changed, or you changed the assignment of interfaces to zones in AFA for any of the devices.

    FireFlow analyzes the device data, and the risk check results appear in the Risk Check Result area.

    The Risk Check Result area displays the number and severity of risks detected, followed by the date and time at which the device data that was used in the risk check was gathered.

  3. To view a risk assessment, click on the desired risk.

    An assessment of the risk opens in a new window.

Do the following:

  1. View the change request. For details, see View change requests.

  2. At the top of the page, click Approve.

    The Approve Change Request page appears.

    Note: For IPv6 traffic requests, and for other traffic requests using the Basic workflow, an email is automatically sent to the requestor after the change request is approved. After the change request is approved, it proceeds straight to the implement stage.

  3. Complete the fields as needed. For details, see Respond to change requests.

  4. Click Next.

The change request proceeds to the Implement stage. See Implementing Changes (see Implement changes).

The email message is sent to the requestor.

If you have the network operations role only (and not the information security role), or if the change request is not for a specific device or policy, the Home page appears.

If you determine that the change request requires modifications, you can return it to the Plan stage. Here is a description of how this is done.

Do the following:

  1. View the change request. For details, see View change requests.

  2. At the top of the page, click Reject.

    The Reject Change Request page appears.

  3. Complete the fields as needed. For details, see Respond to change requests.

  4. Click Next.

The change request is returned to the Plan stage for re-planning.

If you have the network operations role only (and not the information security role), the Home page appears.

If you determine that the change request should not be implemented, you can reject and close it.

Do the following:

  1. View the change request. For details, see View change requests.

  2. At the top of the page, do one of the following:

    • For rule removal requests, click Reject.
    • For other change request types, click , and then click Reject & Close.

    Note: The list of option available in the drop-down list may be changed by an administrator, by editing a workflow's available actions. For more details, see Manage workflow actions.

    A confirmation message appears.

  3. Click OK.

    The Reject Change Request page appears.

  4. Complete the fields as needed. For details, see Respond to change requests.

  5. Click Next.

The email message is sent to the requestor, and the change request is closed.

 

â See also: