CSA rule modules

[ciscors]

1) When I need to modify a rule, should I simply clone the rule or the entire rule module it belongs to. Cisco advises one of this to maintain the original rules for future use

2) Is there anything else I should be cloning?

Thank you

[tsteger1]

Hi Rajiv,

You can always create exceptions to rules instead of modifying the rule itself. If you know you want to change a rule rather than creating an exception, cloning rules inside a rule module and modifying the clone should be sufficient.

One of the downsides to cloning and/or modifying original rules is when you do upgrades to the MC. It will create new rules and append the old version number to your existing rules. This can be tedious to sort out so that you maintain all the modifications you have already accomplished.

This is where making exceptions to existing rules and keeping them in a separate policy can come in handy.

Hope this helps..

Tom S