Policy Workbench

What Is Policy Workbench?

Policy Workbench is a feature within FireMon Policy Planner that gives engineers a workspace to review automated rule recommendations, inspect existing firewall policy, and design changes manually when needed. It delivers rule recommendations and device visibility without requiring full topology mapping, bridging manual and automated change workflows before a plan moves to approval and deployment.

Key takeaways

• Policy Workbench sits inside FireMon Policy Planner, between a firewall change request and its implementation.
• It combines Rule Recommendation's automated suggestions with a workspace for inspecting rules, objects, and placement before committing to a change.
• Engineers can accept a recommendation, refine it, or build a change manually when automated results are incomplete.
• Saving a change plan in Workbench does not deploy it to a firewall; the plan still passes through Policy Planner's risk, compliance, and approval workflow.

Why Policy Workbench Matters

Firewall change requests rarely arrive with a ready-made rule attached. Someone asks for access between two systems, and an engineer has to figure out which device handles that traffic, whether an existing rule already covers it, and how a new rule should be scoped and placed. Doing that analysis by hand, every time, across a large rule base is slow. Accepting an automated suggestion without review carries its own risk, since a recommendation can satisfy the letter of a request while still creating broader access than intended.

Policy Workbench addresses that gap. It gives engineers a single place to see what Rule Recommendation suggests, check that suggestion against the policy already in place, and adjust it or build a change manually if it doesn't hold up. This is also where teams who aren't ready for full automation can still get value: Workbench provides instant rule recommendations and device visibility without requiring complete topology mapping, so practitioners can design and validate changes from day one while working toward more automated workflows over time.

How Policy Workbench Works

Policy Workbench fits into a three-part structure. FireMon Security Manager supplies the underlying visibility into firewall rules, objects, and configurations across supported devices. Policy Planner manages the overall change process, including structured workflows for creating, analyzing, approving, and verifying changes. Policy Workbench is the design step in between: it's where Rule Recommendation's suggested devices and rules get inspected, refined, or replaced before a change plan moves forward.

Rule Recommendation analyzes a requested access and proposes an action, which might be adding a new rule, modifying an existing one, or taking no action at all if access already exists. Workbench is where an engineer decides whether that proposal actually fits. They can inspect the relevant security rule and its associated network and service objects, review the proposed placement, and confirm it aligns with internal naming conventions and policy standards. If the recommendation needs adjustment, or if one isn't available at all, Workbench supports manual rule and object edits on supported devices so the engineer can build or complete the change plan directly.

A Realistic Example

Consider a request to allow communication between two systems. Rule Recommendation identifies the relevant firewall and suggests adding a new, more specific rule above an existing one, because the existing rule is too broad for the request. That recommendation is a starting point, not a finished answer. Firewall rules are evaluated based on the device's policy behavior and rule order, so where the new rule sits relative to the existing one matters.

In Workbench, the engineer opens the recommendation, examines the existing rule's source, destination, and services, and checks whether inserting a more specific rule above it will correctly satisfy the request without leaving the broader rule's access intact for traffic that shouldn't have it. If the recommendation holds up, they select it for the change plan. If it doesn't, they can edit the rule and objects manually within Workbench, or supplement the recommendation with additional changes, before the plan moves forward.

The Operational Consequence

Saving a change plan in Policy Workbench does not deploy anything to a firewall. It preserves the proposed rule and object edits inside Policy Planner. The plan still has to pass through Policy Planner's configured workflow, including risk and compliance assessment and formal approval, before anyone implements it on a device. That distinction matters operationally: a change can satisfy the access request and still introduce a policy violation or added risk, and Workbench's design step is what gives engineers and approvers the chance to catch that before it reaches production rather than after.

Key Components and Best Practices

A complete use of Policy Workbench typically includes a few consistent steps. Start from the access request itself, confirming source, destination, required services, and business purpose, rather than assuming an existing rule's broader permissions should carry over. Open the change plan in Policy Planner and request recommendations before making manual edits. Review the proposed device, rule, and placement, using available context on why a recommendation was made. Inspect the existing policy and associated objects to confirm the proposed change fits correctly. Then save the plan and let it proceed through the remaining risk, compliance, and approval stages rather than treating the save as a finished action.

Common Challenges

Recommendations aren't always straightforward. Some satisfy a request cleanly and only need confirmation. Others require closer inspection, particularly when a recommendation involves changing rule order or modifying a broad existing rule, since placement affects how traffic gets evaluated on the device. And sometimes Rule Recommendation can't produce a complete result at all, due to missing information, device selection issues, or unsupported configurations. Workbench is built to handle all three situations, but it still requires an engineer to recognize which situation they're in and investigate accordingly rather than treating every recommendation the same way.

How This Connects to Network Security Policy Management and FireMon

Policy Workbench is one piece of how FireMon supports the broader discipline of network security policy management (NSPM): governing, validating, and documenting firewall policy changes across an environment rather than making them ad hoc. For a full explanation of that discipline, see FireMon's Network Security Policy Management glossary page.

FireMon, the founder of NSPM, built Policy Workbench into Policy Planner specifically to close the gap between automated rule recommendations and practitioner judgment. Policy is the control plane for network security, and Workbench exists because a recommendation satisfying an access request isn't the same thing as a recommendation that's safe to deploy. By giving engineers a workspace to inspect, adjust, or manually build changes before they enter Policy Planner's risk and compliance workflow, FireMon helps teams move faster without skipping the review that keeps policy changes from introducing unintended access.