Analyze policy change impact

Analyze pending access control policy rule changes to understand their potential impact on network traffic before deploying the changes to production devices.

The Policy Change Impact Analyzer helps administrators assess the consequences of policy modifications by analyzing rule changes, identifying affected traffic segments, and providing historical connection data. This proactive analysis enables informed decision-making during the policy deployment process.

Before you begin

Enable the Policy Change Impact Analyzer toggle under Insights & Reports > Settings.
To view historical impacted connection counts, enable Security Analytics and Logging.
Policy Change Impact Analyzer currently supports Cloud-Delivered Firewall Management Center-managed Firewall Threat Defense devices.

Procedure

Step 1

In the left pane, click Insights & Reports > Policy Change Impact Analyzer.

The Policy Change Impact Analyzer page displays an Impact Analysis summary, including the number of identified impacts.

The device list displays:

Device Name
Job Status
Analysis Result

Step 2

Select one or more devices, and then click Run Impact Analyzer.

You can select up to 10 devices for analysis. The analyzer evaluates the pending policy changes for the selected devices.

Step 3

Monitor the analysis in the device list.

Use the search field to search by device name, analysis result, or job status.

Step 4

Click a device row to open the details pane.

The pane displays the device status and may include these actions:

View change impact details to open the detailed analysis.
Re-analyze to generate an updated result.
Deploy to open the standard deployment workflow.
Workflows to review analysis execution details and errors.

Step 5

Click the device name to open the analysis report.

The analysis details page displays the overall impact assessment for the selected device.

Step 6

Review the Analysis Result, Rule Change Summary, Impacted Traffic Segments, Impacted Connections, and Inferred Impact.

Step 7

If the analysis is incomplete, failed, out of date, or indeterminate, review the policy manually before deployment and rerun the analysis as needed.

Note	Policy Change Impact Analyzer does not deploy, edit, approve, or reject policy changes. Use the standard deployment and change-control process after reviewing the analysis results.

You can also run a Pre-deployment Assessment. It performs the basic assessment and uses Policy Change Impact Analyzer to evaluate saved, pending access control policy changes. The report summarizes affected rules and traffic decision changes, with historical connection evidence when available, to help you review potential impacts before deployment. See Pre-deployment assessments for more information.

The Policy Change Impact Analyzer displays the potential impact of pending access control policy changes, including changed rules, impacted traffic segments, historical connections, inferred impact, and rule change summaries.