Policy Planner Workbench

What Is Policy Planner Workbench?

Policy Planner Workbench is the interface for building and editing change plans within FireMon Policy Planner. Engineers can inspect policy rules and objects, design changes manually, and refine automated recommendations in one workspace across supported vendors.

A live Change Plan drawer tracks proposed changes by device. Saving a plan records the proposed changes; it does not deploy them. Risk and compliance assessments, approvals, implementation, and verification remain part of the applicable Policy Planner workflow.

Key takeaways

• Workbench sits inside FireMon Policy Planner, between a firewall change request and its implementation.
• It brings policy context and change-plan design together: engineers inspect rules, objects, and placement, and can review and refine automated recommendations in the same workspace.
• Engineers can accept a recommendation, refine it, or build a change manually when automated results are incomplete.
• Saving a change plan in Workbench does not deploy it to a firewall; the plan still passes through Policy Planner's risk, compliance, and approval workflow.

Why Policy Planner Workbench Matters

Firewall change requests rarely arrive with a ready-made rule attached. Someone asks for access between two systems, and an engineer has to figure out which device handles that traffic, whether an existing rule already covers it, and how a new rule should be scoped and placed. Doing that analysis by hand, every time, across a large rule base is slow. Accepting an automated suggestion without review carries its own risk, since a recommendation can satisfy the letter of a request while still creating broader access than intended.

Policy Planner Workbench addresses that gap. It gives engineers a single place to design a change plan against the policy already in place, and to review and refine automated recommendations where they are available. Teams that are early in their automation journey can still work effectively here: Workbench provides policy context for supported devices, so engineers can design and validate changes manually. The depth and availability of automated recommendations depend on the data in the environment, including device coverage, configuration detail, and topology information, so results vary by request.

How Policy Planner Workbench Works

Policy Planner Workbench fits into a three-part structure. FireMon Security Manager supplies the underlying visibility into firewall rules, objects, and configurations across supported devices. Policy Planner manages the overall change process, including structured workflows for creating, analyzing, approving, and verifying changes. Workbench is the design step in between: it's where Rule Recommendation's suggested devices and rules get inspected, refined, or replaced before a change plan moves forward.

Rule Recommendation analyzes a requested access and proposes an action, which might be adding a new rule, modifying an existing one, or taking no action at all if access already exists. Workbench is where an engineer decides whether that proposal actually fits. They can inspect the relevant security rule and its associated network and service objects, review the proposed placement, and confirm it aligns with internal naming conventions and policy standards. If the recommendation needs adjustment, or if one isn't available at all, Workbench supports manual rule and object edits on supported devices so the engineer can build or complete the change plan directly.

A Realistic Example

Consider a request to allow communication between two systems. Rule Recommendation identifies the relevant firewall and suggests adding a new, more specific rule above an existing one, because the existing rule is too broad for the request. That recommendation is a starting point, not a finished answer. Firewall rules are evaluated based on the device's policy behavior and rule order, so where the new rule sits relative to the existing one matters.

In Workbench, the engineer opens the recommendation, examines the existing rule's source, destination, and services, and checks whether inserting a more specific rule above it will correctly satisfy the request without leaving the broader rule's access intact for traffic that shouldn't have it. If the recommendation holds up, they select it for the change plan. If it doesn't, they can edit the rule and objects manually within Workbench, or supplement the recommendation with additional changes, before the plan moves forward.

The Operational Consequence

Saving a change plan in Policy Planner Workbench does not deploy anything to a firewall. It preserves the proposed rule and object edits inside Policy Planner. The plan still has to pass through Policy Planner's configured workflow, including risk and compliance assessment and formal approval, before anyone implements it on a device. That distinction matters operationally: a change can satisfy the access request and still introduce a policy violation or added risk, and Workbench's design step is what gives engineers and approvers the chance to catch that before it reaches production rather than after.

Key Components and Best Practices

A complete use of Policy Planner Workbench typically includes a few consistent steps. Start from the access request itself, confirming source, destination, required services, and business purpose, rather than assuming an existing rule's broader permissions should carry over. Open the change plan in Policy Planner and work in Workbench in whichever order fits the request: engineers can design the change manually, or request recommendations and refine them, and they can move between the two. Review the proposed device, rule, and placement, using available context on why a recommendation was made. Inspect the existing policy and associated objects to confirm the proposed change fits correctly. Then save the plan, keeping in mind that saving records the proposed changes rather than deploying them, and let it proceed through the remaining risk, compliance, and approval stages in Policy Planner.

Common Challenges

Recommendations aren't always straightforward. Some satisfy a request cleanly and only need confirmation. Others require closer inspection, particularly when a recommendation involves changing rule order or modifying a broad existing rule, since placement affects how traffic gets evaluated on the device. And sometimes Rule Recommendation can't produce a complete result at all, due to missing information, device selection issues, or unsupported configurations. Workbench is built to handle all three situations, but it still requires an engineer to recognize which situation they're in and investigate accordingly rather than treating every recommendation the same way.

How This Connects to Network Security Policy Management and FireMon

Policy Planner Workbench is one piece of how FireMon supports the broader discipline of network security policy management (NSPM): governing, validating, and documenting firewall policy changes across an environment rather than making them ad hoc. For a full explanation of that discipline, see FireMon's Network Security Policy Management glossary page.

FireMon, the founder of NSPM, built Workbench into Policy Planner specifically to close the gap between automated rule recommendations and practitioner judgment. Policy is the control plane for network security, and Workbench exists because a recommendation satisfying an access request isn't the same thing as a recommendation that's safe to deploy. By giving engineers a workspace to inspect, adjust, or manually build changes before they enter Policy Planner's risk and compliance workflow, FireMon helps teams move faster without skipping the review that keeps policy changes from introducing unintended access.