Did You Know? Automate Rule Documentation with FireMon

A firewall rule can tell you which traffic it matches and what action it takes. It usually can't tell you who still needs that access, why it was approved, or which change request authorized it. When those details live only in a ticket or someone's memory, even a routine rule review turns into an investigation.

FireMon Security Manager has a lesser-known feature that makes that context easier to find: auto-documentation. If your team uses a consistent format in firewall rule comments, FireMon can read those comments when it retrieves the policy and populate corresponding rule documentation fields. That saves administrators from entering the same information again, rule by rule.

Turn a rule comment into fields you can use

Suppose an engineer adds this comment to a firewall rule in the device administration tool:

own: Payments Team; ccn: CHG-4821; jst: Approved connection for payment processing;

FireMon's default match patterns can recognize own, ccn, and jst as the owner, change control number, and business justification. When Security Manager retrieves the policy, it associates the matched values with that rule as structured documentation. FireMon runs auto-documentation as part of each policy revision it processes. The example is illustrative; the values must match the patterns configured in your environment.

That distinction matters. A free-text comment is useful when you're already looking at the rule. Structured fields let you filter and search across rules to answer questions such as: Which rules belong to the Payments Team? Which ones are tied to a particular change number? Which rules are missing a business justification? Security Manager makes matched documentation fields available in its filters and SIQL searches when filtering is enabled.

Rule documentation stays associated with the rule independently of its rule number or revisions. If the rule's position changes in the policy, its documented context doesn't depend on that position.

Start with one repeatable workflow

You don't need to document every rule at once. A practical starting point is a small set of new or recently changed rules:

1. Choose the fields that matter. Owner, change control number, and business justification are useful starting points. Expiration dates may also be valuable for temporary access.
2. Check the match patterns. In Administration, review the Rule Documentation fields and the patterns that extract values from comments. FireMon provides default patterns, and administrators can configure additional fields where needed.
3. Use the agreed format in rule comments. Ask engineers to enter the field markers and values consistently in their device administration tool. Confirm that the device or management station retains those comments and that your team can retrieve them.
4. Inspect the result after retrieval. Open a sample rule in Security Manager and check its Rule Documentation. Then filter or search for the owner or change number to make sure the information is usable beyond that single rule.

The goal is a reliable handoff from the change process to the rule record. When an engineer has to decide whether an old exception is still needed, the owner and original reason are already attached to the rule. When a reviewer needs to trace a rule back to an approved change, the change number is available in the policy view. Documented next review dates can also support reports that identify rules due for review.

Keep the human checks in place

Auto-documentation extracts information that your team provides. It doesn't determine whether a business justification is still valid or whether a named owner is still responsible. Agree on who maintains the source comments, and review the populated fields as part of your normal change and recertification process.

If you customize a match pattern, test it before using it broadly. Start with a small sample of comments and confirm the results before extending the format across devices.

For firewall administrators, this is a modest change with a useful payoff: context entered during a change becomes searchable rule documentation during ongoing policy management. That makes it easier to investigate access, review aging rules, and explain why a rule exists without rebuilding its history from scratch.

Explore FireMon Security Manager to see how searchable rule documentation can make firewall policy reviews easier.