Create and Manage Policy Versions

You create a policy version by taking a snapshot of another policy. You can create versions for all types of policies including All Devices, Group, Device, and Device exceptions.

The maximum number of versions maintained for any policy is 60. If the maximum limit is reached, you must delete the unwanted versions before saving a new version. Versioning and rollback are independent operations for each policy.

For example, if you take a snapshot of a group firewall policy, or roll back to a previous firewall policy version, it does not change the version for all device policy rules; you must separately version each policy rule.

Create Policy Snapshots
Manage Policy Versions
Roll Back Policy Versions
Compare Policy Versions
Delete Policy Versions

Create Policy Snapshots

Procedure

To create a policy version:

Select Configure > IPS Policy > Policies.
Select the check box next to the policy for which you are taking a snapshot, and then right-click the policy or click More.
A list of actions appears.
Select Manage/Rollback Policy.
The Manage Version page appears.
Click Create Snapshot.
The Snapshot Policy page appears.
Enter your comments in the Comments field, and click Create to take a snapshot. The Snapshot Policy window appears, showing the status of the version as it is created.
Note During policy publish, Security Director takes an automatic snapshot of the policy.

Manage Policy Versions

You can view or manage all available versions of a selected policy. You can perform the following tasks on the snapshots:

Roll back to a specific version.
View the differences between any two versions (including the current version) of the policy
Delete one or more versions from the system.

Roll Back Policy Versions

Procedure

To roll back the selected version so it becomes the current version:

Select Configure > IPS Policy > Policies.
Select the check box next to the policy for which you are rolling back a version, and then right-click the policy or click More.
A list of actions appears.
Select Manage/Rollback Policy.
The Manage Version page appears.
Select the version that you want to make as the current version, and click Rollback.
The rollback operation replaces all the rules and rule groups of the current version with rules and rule groups from the selected version. For all the shared objects, Object Conflict Resolution (OCR) is done. If there are any conflicts between the versioned data and the current objects in the system, the OCR window is displayed.
After finishing any conflict resolution, click Next to view the OCR summary report.
Click Finish to replace the current policy with the versioned data. A summary of the snapshot policy is shown by clicking Snapshot.

Compare Policy Versions

Procedure

To compare two different versions of a policy:

Select Configure > IPS Policy > Policies.
Select the check box next to the policy for which you want to compare versions, and then right-click the policy or click More.
A list of actions appears
Select Manage/Rollback Policy.
The Manage Version page appears.
Select the versions to be compared, and click Compare. You can only compare two versions at a time.
The Compare Versions page appears.
Click Compare to view the results.
A Compare Versions results window appears showing the differences between the selected versions.

The Compare Versions results window has the following sections:

Policy Property Changes—Shows policy changes for the modified rules.
Rule Changes—Displays rules that are added, modified, or deleted.
Column Changes—Shows the differences between the column content for modified rules.

Delete Policy Versions

Procedure

To delete a policy version:

Select Configure > IPS Policy > Policies.
Right-click the policy or profile or click More.
A list of actions appears.
Click Manage/Rollback Policy.
The Manage Version page appears.
Select the policy version you want to delete and click Delete.
A warning message is displayed.
Click Yes to confirm the deletion.
The selected policy version is deleted.