Configuring Designer to Disable Group Modification

Overview

By default, when an access request (AR) matches an NST device rule whose match condition is a shared group, Designer adds the new object to the group itself. If that group is referenced by other rules, this also changes the matching for those other rules.

From TOS 5.3, to change this default behavior, add the <Designer_Access_Request_No_Modify_Group> flag to StConf and set it to true. When set, Designer adds the new object to the rule instead of the group. This leaves the group's membership unchanged, so other rules that rely on it are not affected.

Affected NST devices

This flag is global and when configured affects Designer behavior for the following NST devices:

  • Cisco: Routers, ASA, ACI, FMC

  • Fortinet: FortiManager (FMG), Standalone

  • Palo Alto: Standalone, Panorama

  • Azure: VNets

  • Amazon: VPC

  • Check Point: All

  • Stonesoft: All

  • VMware: NSX DFW

  • Juniper: NetScreen, SRX

  • McAfee: All

Configure disable group modification flag

Follow these steps to configure the <Designer_Access_Request_No_Modify_Group> flag.

  1. Navigate to: https://<SecureTrack_IP>/securetrack/admin/stcgitest.htm

  2. Navigate to Edit StConf > Fetch StConf.

  3. At the end of the StConf file, add:

    4. <Designer_Access_Request_No_Modify_Group>true</Designer_Access_Request_No_Modify_Group>     

  4. Click Submit New Conf.

Related topics

StConf configuration