Before administrators push configuration changes to managed firewalls, Require them to review the push scope selection (

Commit

Push to Devices

Edit Selections

) to verify that the list of target firewalls is correct.

Even if the device group hierarchy is designed correctly and the configuration changes are well planned, there may be scenarios where configuration changes do not need to be pushed to all firewalls at a given time due to different maintenance windows. It is always a best practice to review the list of target firewalls to ensure configuration changes are pushed to only the intended managed firewalls.

Use the

Force Template Values

(

Commit

Push to Devices

Edit Selections

) setting sparingly. A push with this setting enabled overwrites the entire managed firewall configuration including any local firewall configuration.