Automated Firewall Change Software

Policy Planner is FireMon's firewall change automation software. It manages the full change lifecycle, analyzing proposed rules in real time, checking them against compliance requirements, and deploying them safely across on-premises and cloud environments. It runs as an add-on to FireMon Security Manager.

It performs real-time risk assessments and compliance checks before changes are made. It automatically detects if a proposed rule exposes vulnerable systems or violates policy, enabling teams to fix issues before implementation.

Yes. It automates the entire rule lifecycle, including rule creation, analysis, and deployment. It stages changes, tracks approvals, and integrates with ITSM tools for efficient and auditable workflows. Workbench provides the interface for preparing change plans within Policy Planner’s change workflow.

Yes. It performs pre-deployment compliance checks to ensure all proposed rules meet internal and regulatory requirements such as PCI DSS, NERC-CIP, NIST, and DORA, preventing non-compliant rules from entering production.

Policy Planner focuses on safe change creation and deployment. Identifying redundant, shadowed, or unused rules is handled by Policy Optimizer, and when the two are paired, rule decommissioning is fully automated, closing the loop from rule creation through removal.

Policy Planner integrates with ServiceNow and Remedy, enabling ticket tracking, comment logging, attachment uploads, and automated reviews across change management workflows.

Yes. It's fully customizable to align with your business process management model, supporting custom forms, workflows, and rule validation criteria tailored to your internal controls and audit needs.

No. While it supports firewall rule changes, it also handles modifications to network objects, service objects, and group objects across hybrid and multi-cloud environments.

Recommendation results depend on available policy and network information. Workbench also supports manual change design when recommendations are incomplete or unavailable, within supported device and workflow capabilities.

Yes. Policy Planner is an add-on module that requires FireMon Security Manager as the foundational platform.

Workbench is the interface for building and editing change plans within Policy Planner. Engineers can inspect policy rules and objects, design changes manually, and refine automated recommendations. The resulting plan continues through the applicable Policy Planner workflow before implementation.

No. Saving records the proposed changes. Implementation occurs later through the applicable Policy Planner workflow.

Workbench must be enabled using an API call with assistance from FireMon Support before it becomes visible in the Policy Planner interface. At general availability, Workbench applies to Access Request tickets. Contact FireMon Support to enable Workbench in your environment.

View documentation

At the general availability release, Workbench supports the Access Request workflow only. When Workbench is enabled, only Access Request tickets can be processed. Other workflow ticket types are not supported in Workbench; to work those tickets, you must disable Workbench.

The Change Plan Editor, Real-Time Change Plan Drawer, Bulk Delete, and Change Plan Status Badges features are all available with Access Request workflows in this release.

View Documentation

Workbench Agentic AI provides a guided, AI-assisted experience for rule recommendations. When you open a Workbench Change Plan ticket and select Automatic Recommendations, the agentic AI assistant analyzes your environment to identify impacted devices and policies, then generates rule and object change recommendations with names shaped by both device requirements and your existing naming conventions. You can interact with the AI throughout to ask questions about why specific devices were chosen or what would happen with different options.

Nothing happens unattended: engineers review and save the proposed changes, and the plan then proceeds through the applicable assessment and approval workflow before implementation. A FireMon Insights activation is required.

View Documentation