Pre-deployment assessments

In the Cloud-Delivered Firewall Management Center menu bar, click Deploy to run pre-deployment assessments. You can run pre-deployment assessments to proactively verify your environment's runtime readiness and policy configurations, before deployment. These assessments help you remediate issues before they cause network outages or security incidents.

Click Pre-deployment Assessment in the Quick Deploy banner to perform two types of pre-deployment assessments:

  • Basic assessment

  • Advanced assessment

Basic assessment

This assessment runs rule-based checks to identify blockers and misconfigurations, including policy, device, runtime, dependency, and certificate expiration risks, before deployment. It validates your configurations and reports the status of each check. Use the details in the assessment report to remediate any issues found.

To run basic assessment on a Firewall Threat Defense device:

  1. In the Cloud-Delivered Firewall Management Center menu bar, click Deploy.

  2. Click Pre-deployment Assessment in the banner or Advanced Deploy.

  3. In the Advanced Deployment screen, select one or more devices.

  4. Choose Run Assessments > Basic Assessments.

    You can view the state of the assessments, and click View report to view the Assessment report. This report displays a summary of the findings, groups them by severity, and provides the description, component, cause, and recommended remediation for each issue.

Advanced assessment

This assessment uses AI to analyze your firewall policies and evaluate their risk profile before you deploy them on the Firewall Threat Defense devices. It provides deeper insights into how the changes might impact your network, allowing you to review and fine-tune your policies before deployment.

Advanced Assessment compares the last deployed access control policy with the proposed policy, including saved changes that are pending deployment.

The assessment identifies traffic whose effective policy decision would change, such as traffic that becomes allowed or blocked. When historical connection events are available, the assessment also shows observed traffic that matches the affected traffic segments.

Use the assessment results to:

  • Review affected rules and traffic.

  • Confirm that the result matches the intended policy change.

  • Revise and rerun the assessment, if needed.

Running an assessment does not change or deploy the policy.

Note

To run the advanced assessments, you must enable the Policy Change Impact Analyzer in Security Cloud Control. Choose Insights & Reports > Settings.

When you run this assessment, it automatically performs two checks:

  1. Basic assessment

  2. AI-based assessment using Policy Change Impact Analyzer.

To run an advanced assessment on a Firewall Threat Defense device:

  1. In the Cloud-Delivered Firewall Management Center menu bar, click Deploy.

  2. Click Pre-deployment Assessment in the banner or Advanced Deploy.

  3. In the Advanced Deployment screen, select one or more devices.

  4. Choose Run Assessments > Advanced Assessments.

    Cloud-Delivered Firewall Management Center starts the assessment. Policy Impact Analyzer evaluates the saved, pending access control policy changes for each eligible device.

    Monitor the state of the assessments, and click View report to view the Assessment report. This cross-launches the Policy Change Impact Analyzer page for the selected Firewall Threat Defense device, where you can review the result and supporting details.

Related information