Table of Contents

Deploying Configuration Files

Firewall MC offers three methods for managing changes and deploying configurations.

When workflow is enabled, the GUI displays the Workflow tab so you can manage activities and jobs. When workflow is disabled, the GUI displays the Deployment tab. You can use the Deployment tab to view deployment status information and to deploy saved configurations to devices.

You control which of these methods to use for tracking changes. You can enable workflow with or without the formal approval process at any time; however, before you can disable workflow, you must approve or discard any open activities and deploy, cancel, or verify that all jobs are being deployed.

Topics to be discussed are:

Managing Deployment with Workflow Disabled

When workflow is disabled (default), you do not need to define activities for tracking changes in Firewall MC. After you make configuration changes, you can deploy those changes by clicking the Save and Deploy icon in the activity bar that is visible from the Devices and Configuration tabs. After you click Save and Deploy, new configurations are generated for any changed devices. You can then deploy the new configurations, or you can save them and deploy them later. For more information on deploying saved configurations, see Using the Deployment Tab.

The Deployment tab is visible only when workflow is disabled. When you enable workflow, the Deployment tab is replaced by the Workflow tab, and you manage deployments by using jobs. For information on using jobs for deployment, see Using Job Management.

Note   When you log in to Firewall MC, you might see a Generate Summary page displayed instead of the Home Page. This occurs if you closed the browser while a configuration was being generated the last time you were logged in.

Important Notes When Workflow Is Disabled

Using the Activity Bar

When workflow is disabled, you use the activity bar in the Devices and Configuration tabs to generate configurations for changed devices, undo changes, and view changes that were made since the last save. Table 15-1 shows the activity bar icons when workflow is disabled.

Generating Configurations for Modified Devices

Before you can deploy configuration changes to a device, you must generate the configuration. You are not required to deploy a configuration when you generate it. You have the option of saving the configuration for deployment later. You generate new configurations for modified devices using the Save and Deploy icon, which is located in the activity bar that is visible from the Devices and Configuration tabs.

The Generate Summary page appears and the Generate Status table shows the devices that are being deployed and their status. When a configuration generation is in process, you can refresh the page for updated status or stop the configuration generation.

After configuration is complete, you can view the configurations.

Step 2   To view the configurations, click View Config in the Details column.

Step 3   Close the window after you view its contents.

Step 4   Do one of the following:

Understanding the Generate Summary Page

Figure 15-1 shows the Generate Summary page and Status table.

Understanding Generate Summary Icons

Understanding Deployment States

Viewing Configuration Changes

A popup window opens to display configuration changes made since the file was last saved.

Step 2   Close the window after you have viewed its contents.

Using the Deployment Tab

From the Deployment tab, you can review the status of configuration deployments, and you can deploy saved configurations for devices. The Deployment tab contains the following options:

Viewing Deployment Status Information

The Deployment Status Summary page appears.

Step 2   Do one of the following:

From the Deployment Status popup window, you can select View Config to see a device's configuration, or, if the configuration is deployed directly to a device, you can select View Transcript to see the deployment transcript for a device.

Understanding the Deployment Status Summary Page

Figure 15-2 shows the Status Summary page, which you access from the Deployment tab.

Deploying Saved Configurations

The Deploy Saved Changes page appears.

Step 2   Select the devices for which to deploy the most recent saved configurations.

Step 3   Click Deploy.

The Deployment Status popup window appears (Figure 15-3).

Step 4   Verify that the status for each device is shown as completed and the deployment method is correct as noted.

Tip If deployment for a device is unsuccessful, see the Details column of the Deployment Status table for deployment error information.

Step 5   To view the configuration for a device in the table, click the View Config link located in the Detail Information column.

A popup window opens in which you can view the configuration.

Step 6   Verify the configuration contents, then close the window.

You return to the Deployment Status window.

Step 7   Click Close.

The Status Summary page displays the status of the deployment.

Understanding the Deployment Status Popup Window

Figure 15-3 shows the Deployment Status Popup window.

Managing Deployment With Workflow Enabled

Many organizations benefit from separating responsibility for defining, implementing, and deploying corporate firewall policies. For example, a security administrator might be responsible for defining a device configuration file, another administrator for approving the configuration file, and a network operator for deploying the resulting configuration to a device. This separation of responsibility helps maintain the integrity of deployed device configurations.

Firewall MC supports this separation of responsibility using activities and jobs, which define tasks that are accomplished by one or more people in succession.

Note   You can set up Firewall MC to require formal approval for both activities and jobs. This approval process is disabled by default, but you can enable it by selecting Admin > Workflow Setup.

Topics to be discussed include:

Using the Workflow Tab

From the Workflow tab, you can view the Activity Management table and Job Management table. The Activity Management table allows you to create activities that help you identify and control policy changes. When you create a new activity, you are preparing a proposal to create or change firewall device configurations. For more information, see Using Activity Management.

After an activity is approved, the corresponding configuration elements can be downloaded to several devices in the form of a job. A job identifies devices to which configuration files will be deployed. When workflow is enabled, you must select a job to deploy configurations. To access the jobs feature, select Workflow > Job Management.

Using Job Management

A job represents a set of configuration files to be deployed to devices, configuration files, or an AUS. After a job is defined, you can submit it for approval.

A job identifies a set of devices, new configuration files for downloading, and defines a method for deployment. After a job is defined, it is submitted for approval. Upon approval, it is ready for deployment.

During the process of identifying and approving a job for deployment, you are required to select activities that are associated with the job. When you select an activity in the wizard for deployment, then select a device, you might see other activities associated with the job that you did not select. This behavior is expected. The reason is that any approved activity that includes changes for the device is used to generate the commands.

Topics to be discussed include:

Understanding Job Actions and States

Firewall MC keeps a history of actions made with each job, from creating a job to deploying a job. You also have the option of canceling a job, which cancels a job that is being deployed. The Job Management table shows the most recent action state in the Last Action column. Also included are the job name, job state, username, and devices affected by the job.

Figure 15-4 shows the Job Management table. The formal approval process is enabled. As a result, additional buttons (Submit and Reject) are displayed that would otherwise not be visible. Job buttons are grayed-out depending upon the state of the job that you select.

A job can have the following states:

Adding a Job

After an activity is approved and committed, you must create a job to deploy the updated configurations to devices.

Note   The job comprises the results of all committed activities. A partial set of committed activities cannot be deployed.

The Job Management page appears.

Step 2   Click Add.

The Job Name page appears.

Step 3   Enter a user-defined job name.

Step 4   Enter an optional comment in the Description field.

Step 5   Click Next.

The Select Activities page appears.

Step 6   Select the activities to assign to the job.

Step 7   Click Next.

The Select Devices page appears.

Step 8   Select or deselect any additional devices to add or remove from this job.

Step 9   Click Next.

The Review Devices page appears, which lists the activities that will be deployed to each device.

---

Note    All approved activities that have not already been deployed to a device must be deployed when a device is included in a job.

---

Step 10   From the Review Devices page:

Step 11   Click Next.

The Job State Change page appears.

Step 12   From the Job State Change page, do one of the following:

Step 13   Verify the information is correct, then click Finish.

You are returned to the Job Management table.

Note   If the state shows Deploy Error(s), there was a problem with one or more devices in the job. Select the job, then click Status for more information about the errors.

Tip If you are deploying directly to a device, you can select a device, then click View Transcript to view information about the communications to the device.

For more information, see Deploying a Job.

Job Management Field-Level Elements and Descriptions

Submitting a Job for Review (Approval Process Enabled)

After a job is defined, you can submit it for review and approval. If the job is approved, it is forwarded for deployment. If the job is rejected, it can be modified, then resubmitted for approval.

If the job is rejected, the approved activities and configuration files associated with the job remain unchanged.

Note   The review and approval feature is disabled by default, but you can enable the feature if your organization requires a formal approval process. See Requiring a Formal Approval Phase.

The Job Management page appears.

Step 2   Select the job to submit for approval.

Step 3   Click Submit.

Approving or Rejecting a Job (Approval Process Enabled)

Only a person with approval authority can approve a job if the formal approval process is enabled. After an job is approved, however, it cannot be changed. If content changes are required, you must create a new job to replace it.

A job can be rejected for several reasons. Perhaps configuration information might need changes. If a job is rejected, you can revise it, then resubmit for approval.

Although the job was rejected, the approved activities and configuration files associated with the job remain unchanged.

Note   The review and approval feature is disabled by default, but you can enable the feature if your organization requires a formal approval process. See Requiring a Formal Approval Phase.

The Job Management page appears.

Step 2   Select the job to approve or reject.

Step 3   Do one of the following:

You are prompted to enter an optional activity transit comment.

Step 4   Enter the optional information, then click OK.

You are returned to the Job Management table with Approved or Rejected displayed in the State column. Updated information is noted in the Last Action column.

Deploying a Job

After a job is approved, the final stage is to deploy the job.

Note   If the deployment fails, you can roll back to the previously deployed configuration files. See Configuring Rollback.

Before You Begin

The Job Management page appears.

Step 2   Select the job to deploy.

Step 3   Click Deploy.

You are prompted for a job deploy comment.

Step 4   Enter the optional information in the field provided, then click OK.

A status popup window opens. The window refreshes automatically every 60 seconds. You can click Refresh to update status information manually.

Step 5   Close the window after you view the contents,

You are returned to the Job Management table. The job state for the job being deployed is shown as Deploying in the State column. Upon completion of the deployment, click Refresh in the Job Management table to update the state from Deploying to Deployed.

Note   If the state shows Deploy Error(s), there was a problem with one or more devices in the job. Select the job, then click Status for more information about the errors.

Tip If you are deploying directly to a device, you can select a device, then click View Transcript to view information about the communications to the device.

Opening an Existing Job

The Job Management page appears.

Step 2   Select the job to edit, then click Open.

The Job Name page appears.

You are now ready to edit job settings.

Configuring Rollback

Note   Before you can access the rollback feature, you must enable workflow. To do this, select Admin > Workflow Setup.

After you deploy a configuration, you might need to disregard the deployment and revert to the previous configuration file. Perhaps the deployment was not successful, or you simply want to revert to the previous configuration settings for certain devices. To do this, you can roll back to a previous configuration.

The rollback feature allows you to write the last good configuration files for some or all devices within a job. The configuration files are stored in the directory you specify in the rollback wizard. To access this feature, select Workflow > Job Management.

You do not need to submit a rollback request for approval (if the job approval feature is enabled); however, you must have the needed permissions to initiate the rollback.

Using Rollback

The Job Management page appears.

Step 2   Select the job for which you want to roll back deployment. The job state should display Deployed or Deploy Error(s) in the State column.

Step 3   Click Rollback.

The Rollback Comment page appears.

Step 4   Enter the rollback comment in the field provided. The text string can be up to 235 characters.

Step 5   Click Next.

The Select Devices page appears.

Step 6   Select the devices to roll back to the previously deployed configuration file from the list of devices scheduled for job deployment.

---

Note    If you selected a device that does not have a previous configuration file, an error message is displayed. You must deselect the device to continue with the rollback.

---

Step 7   Click Next.

The Rollback Directory page appears.

Step 8   Verify the rollback directory path. This is the directory to which the configuration files are written. You can click Browse to open a popup window for directory path information. The default directory path is C:\Program Files\CSCOpx\MDC\PIXMC\rollback.

---

Note    If you set a different directory location, we recommend that you not use the directory in which the previously deployed files reside to avoid the risk of overwriting good files. If you set a different directory location, make sure it is a secured directory.

---

Step 9   Click Next.

The job summary page appears.

Step 10   Verify the information is correct, then click Finish.

The rollback process begins. You are returned to the Job Management table. The job selected for rollback displays the message Rolling Back in the State column.

Step 11   Click Finish.

The refresh rate occurs automatically every 60 seconds; however, you can click Refresh to update the display manually. When the rollback is complete, the message Rolled Back is displayed in the State column and the rollback configuration is placed in the specified directory path.

Step 12   To update the configuration on a firewall device with the rollback configuration:

Caution   Applying the rollback configuration to the firewall device causes the device and Firewall MC to lose synchronization. In other words, the information in Firewall MC still represents the state of the firewall device prior to the rollback. You should use the rollback procedure as a way to quickly correct a configuration that is not secure or blocks required traffic. However, you must remember to make the required corrections to the firewall device's configuration in Firewall MC and then deploy the corrected configuration using Firewall MC to restore synchronization.

---

Note    This procedure assumes the TFTP server is located on the inside.

---