Workflow Template
Firewall Change Request Workflow
Manages firewall/network rule change requests end-to-end: intake, security risk review, risk-based approval routing (security manager for high risk, network owner otherwise), implementation and testing, and — for temporary rules — scheduled removal, with status tracking and requester notifications throughout.
Organisations managing network infrastructure need a consistent, auditable way to handle firewall change requests, particularly when risk levels vary and approval authority must shift accordingly. This workflow manages the full lifecycle of a firewall change request from intake through security risk assessment, risk-based approval routing to either the security manager or network owner, implementation and testing by the network team, and — for temporary rules — scheduled removal. Requesters, the security team, the security manager, the network owner and the network team are each involved at defined points, with the requester kept informed by email throughout.
Business Outcomes
- Supports more consistent risk assessment before firewall changes are approved
- Helps route approvals to the right authority based on risk level
- Reduces manual follow-up by keeping requesters informed automatically at each stage
- Makes implementation and test results easier to track on each record
- Helps reduce the chance temporary rules are left in place past their removal date
Workflow Steps
Steps
- 1Create Firewall Change Request Recordcreate record
Registers the submitted firewall change request as a record.
- 2Set Status to Submittedupdate record
Updates the record status to Submitted.
- 3Email Acknowledgement to Requestersend email
Sends the requester an acknowledgement email with their reference number.
- 4Set Status to Security Reviewupdate record
Updates the record status to Security Review.
- 5Security Team: Risk Assessmentcreate task
Assigns the security team a task to assess and record the risk level and comments for the requested change.
- 6Save Risk Assessment to Recordupdate record
Persists the risk level and comments captured by the security team onto the record.
- 7Route Approval Based on Risk
Routes high-risk changes to the security manager for approval and all others to the network owner.
risk_level: "High"→Security Manager ApprovalDefault→Network Owner Approval - 8Security Manager Approvalrequest approvalrequires approval
Requests the security manager's approval for this high-risk firewall change.
- 9Route Security Manager Outcome
Routes the workflow based on the security manager's approval decision.
approval_status: "approved"→Set Status to Implementingapproval_status: "rejected"→Set Status to RejectedDefault→End - 10Network Owner Approvalrequest approvalrequires approval
Requests the network owner's approval for this firewall change.
- 11Route Network Owner Outcome
Routes the workflow based on the network owner's approval decision.
approval_status: "approved"→Set Status to Implementingapproval_status: "rejected"→Set Status to RejectedDefault→End - 12Set Status to Rejectedupdate record
Updates the record status to Rejected.
- 13Email Requester: Not Approvedsend email
Notifies the requester that their firewall change request was not approved.
- 14Set Status to Implementingupdate record
Updates the record status to Implementing.
- 15Network Team: Implement and Test Rulecreate task
Assigns the network team a task to implement and test the approved rule change.
- 16Save Implementation Details to Recordupdate record
Persists the date implemented and test result captured by the network team onto the record.
- 17Set Status to Implementedupdate record
Updates the record status to Implemented.
- 18Email Requester: Change is Livesend email
Notifies the requester that the firewall change has been implemented and is live.
- 19Check if Change is Temporary
Routes temporary changes to the removal task; permanent changes end here.
change_duration: "Temporary"→Network Team: Remove Temporary RuleDefault→End - 20Network Team: Remove Temporary Rulecreate task
Assigns the network team a task to remove the temporary rule on the scheduled removal date, with no due date set.
- 21Save Removal Date to Recordupdate record
Persists the date the temporary rule was removed onto the record.
- 22Set Status to Removedupdate record
Updates the record status to Removed.
- 23Email Requester: Temporary Rule Removedsend email
Notifies the requester that the temporary firewall rule has been removed.
Fields
Show all 15 fieldsShow fewer fields
FormFirewall Change Request
- Requester Name*· Text
- Requester Email*· Email
- Requested Rule*· Long text
- Source*· Text
- Destination*· Text
- Ports and Protocols*· Text
- Business Justification*· Long text
- Is this change Permanent or Temporary?*· Choice
- Removal Date (if Temporary)· Date
TaskSecurity Team: Risk Assessment
- Risk Level*· Choice
- Risk Assessment Comments· Long text
TaskNetwork Team: Implement and Test Rule
- Date Implemented*· Date
- Test Result*· Long text
TaskNetwork Team: Remove Temporary Rule
- Date Removed*· Date
Other fields
- Change Status· Choice
- Requester Name*
- Requester Email*
- Requested Rule*
- Source*
- Destination*
- Ports and Protocols*
Forms
Firewall Change Request
9 fields
Data Views
Firewall Change Requests
requested_rule, source, destination, risk_level +2 more
Dashboard Widgets
Recommended integrations
Setup the following integrations to extend workflow capability.
Send email in the workflow
AWS SES
Similar Workflows
Similar Categories
FAQs
What does this workflow record for each firewall change request?
Each request becomes a record with a reference number, a status, and a timeline of what happened. The record captures the details submitted on the request form, the risk level and comments entered by the security team, the approval outcome, the date implemented and test result from the network team, and for temporary rules the date the rule was removed.
Who is involved in reviewing and approving a firewall change?
The security team is assigned a task to assess and record the risk level for the requested change. Based on that risk level, the workflow routes the approval task to either the security manager for high-risk changes or the network owner for all other changes, and the network team is later assigned the implementation and any removal tasks.
How does the workflow decide whether the security manager or network owner approves a change?
After the security team records a risk level on the record, the workflow checks whether that risk level is High. High-risk changes are routed to the security manager for approval, while all other risk levels are routed to the network owner.
What happens if a firewall change request is rejected?
If either the security manager or network owner rejects the request, the record's status is set to Rejected and the requester is notified by email that their request was not approved. This outcome, along with who reviewed it and when, is kept in the record's timeline.
How do we change this workflow if our approval process is different?
A workflow can be changed by describing the change in plain English or by editing its steps directly in the workflow editor, and earlier versions are kept. This makes it straightforward to adjust routing rules, task assignments or notification wording as approval requirements evolve.
What is tracked when the network team implements and tests a rule change?
The network team is assigned a task to implement and test the approved rule, and the workflow waits for that task to be completed. The date implemented and the test result entered on that task are saved onto the record, and the status is updated to Implemented once complete.
How does the workflow handle temporary firewall rules?
When a request is marked as Temporary on the intake form, the workflow routes it to a removal task assigned to the network team on the scheduled removal date. Once the network team records the date removed, the record's status is updated to Removed and the requester is notified by email.
Does the requester need an account to submit or track a firewall change request?
No account is required. Requesters submit their request through a public request form and receive updates by email, including an acknowledgement with their reference number, at each key stage of the process.
Can the workspace track the status of all firewall change requests in one place?
Yes, table views and dashboards show records by status, such as Submitted, Security Review, Implementing, Implemented or Removed. Workspace activity is also logged, giving oversight of requests as they move through review, approval, implementation and removal.
Ready to use this workflow?
Create a free account and customise this workflow for your business.