Organizations managing multiple devices do not want to manually enter new rules or manually upload new versions of access lists to each router and firewall whenever there is a change to policy or a need to respond to a threat. |
Managers who are responsible for networking infrastructure need a way to verify that the policies that are developed for the network are actually being implemented correctly and applied as directed. |
Configuring access control lists is an area that has basically all of the concepts in common between vendors, and no standard for the syntax or format. The disparity between devices is not only a drain on manpower in organizations, but it also a hindrance to adopting better solutions when they become available. |
Organizations also need a way to track what changes have been made to their access lists both globally and on a per device basis for troubleshooting and for ensuring compliance to policy. When a policy related problem occurs, anyone responsible for finding the solution needs the ability to see what has changed. |