{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":29661,"path":"it-operations-management/discovery/firewall-requests.md","title":"Firewall rule requests","bundle":null,"doc_type":null,"release":"australia","body":"\n# Firewall rule requests\n\nUse Service Catalog to request new firewall policies and rules.\n\n\\[Omitted image \"request\\_new\\_firewall.png\"\\] Alt text: Request new firewall rule\n\n**Parent Topic:**[Using Firewall Audits and Reporting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/discovery/firewall-audit-report-use.md)\n\n## Request a firewall rule\n\nRequest one or more firewall rules using Service Catalog to manage various IP addresses and enhance network security and accommodate evolving business requirements.\n\n### Before you begin\n\nVerify that the Firewall Audits and Reporting catalog is enabled.\n\nRole required: firewall\\_admin\n\n### About this task\n\nYou can request multiple firewall rule configurations in a single request. The system creates one parent firewall task with individual configuration tasks for each rule. Administrators initiate tasks, which are automatically directed to the risk team for assessment and approval. Following approval, firewall admins smoothly implement changes, all orchestrated through automated workflows.\n\n**Note:** Starting with version 1.12.0 of Firewall Audits and Reporting, all new firewall rule tasks are created in vendor-specific tables and display the task type based on the selected vendor. Open requests created before version 1.12.0 are read-only. To proceed with those requests, resubmit them using the current catalog form.\n\n### Procedure\n\n1.  Navigate to **All** > **Service Catalog** > **Firewall Rules**.\n\n2.  Select **Request Firewall Rule**.\n\n    \\[Omitted image \"request\\_firewall\\_form.png\"\\] Alt text: Request firewall form.\n\n3.  Enter the appropriate information for the following mandatory fields.\n\n4.  -   Source IP address\n-   Destination IP address\n-   Assignment Group\n\n    Must have the **sn\\_disco\\_firewall.firewall\\_user** role.\n\n-   Approval Group\n\n    Must have the **approver\\_user** role.\n\n5.  Enter or select any details that is required.\n\n6.  To add additional rule configurations, select **Add Rule Config** and enter the details for each additional rule.\n\n    Each rule configuration you add creates a separate configuration task under the same parent firewall task. All configurations share the common fields such as Assignment Group and Approval Group.\n\n7.  Select **Submit**.\n\n    The system creates one parent firewall rule task with individual configuration tasks for each rule you specified.\n\n\n### What to do next\n\nTo verify the new rule task, navigate to **Rule Requests** > **Rule Requests Task**. Your request appears in the list with the task type set to the selected vendor. Open the parent task to view all individual rule configuration tasks.\n\n## Approve firewall requests\n\nApproval of firewall requests gives you controlled access and compliance. Members of the approver group can review and approve firewall audits and new firewall requests.\n\n### Before you begin\n\nRole required: Members of the specified approver group **approval\\_group** specified in the rule task. The admin user can edit the approvers list in the Rule Request Task.\n\n### Procedure\n\n1.  Navigate to **All** > **Self Service** > **My Approvals**.\n\n2.  Select the green checkmark to approve.\n\n\n### Result\n\n-   The Assignment group works on the request and marks it as **Close Complete**.\n-   Once the assignment\\_group marks the request **Close Complete**, if the change request plugin is activated, a background sub-flow creates a change request.\n\n    **Note:** The change request is created only if the rule task is **Approved** and in **Close Complete** state.\n\n\nThe Firewall rule task security policy M2M corresponds to the related list **Security policies** in **Rule task**. Firewall administrators can add **description** or **tag** fields in a security policy on a Panorama device. They can also add firewall rule task numbers or change request numbers while creating or modifying security policies on Panorama. When the next discovery runs, the M2M table populates the mapping between:\n\n-   Firewall rule task and firewall security policy\n-   Firewall security policy and business service if the business service is provided during the Firewall rule task request\n\n"}}