# Updating a rule group for a Next Generation policy
<a name="rule-groups-v2-updating"></a>

To change your rule group settings, use the following procedure.

**To update a rule group for a Next Generation policy**

1. Sign in to the Amazon Web Services Management Console and open the Amazon VPC console at [https://console.amazonaws.cn/vpc/](https://console.amazonaws.cn/vpc/).

1. In the navigation pane, under **Network Firewall**, choose **Network Firewall rule groups**.

1. In the **Network Firewall rule groups** page, choose the name of the rule group that you want to update. The rule group's details page appears.

1. In the rule group's details page, in the area that you want to change, choose **Edit**. Follow the prompts to make your updates. The interface varies according to the rule group type and the authoring format. When you're done editing an area, choose **Save** to save your changes.
**Note**  
You can't change a rule group's name, type, or capacity after you create it.

To update a rule group with the Amazon CLI, use `update-rule-group` with the matching `--type` and a current `UpdateToken` from a preceding create or describe call. The token changes with every update.

**How Network Firewall propagates your changes**  
When you make any changes to a firewall, including changes to any of the firewall's components, like rule groups, TLS inspection configurations, and firewall policies, Network Firewall propagates the changes everywhere that the firewall is used. Your changes are normally applied within minutes, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. For example, if you modify a rule group so that it drops an additional type of packet, for a firewall that uses the rule group, the new packet type might briefly be dropped by one firewall endpoint while still being allowed by another. 

This temporary inconsistency can occur when you first create a firewall and when you make changes to an existing firewall. Generally, any inconsistencies of this type last only a few seconds. 

When you add a TLS inspection configuration to an existing firewall, Network Firewall interrupts traffic flows that match the criteria defined by the TLS inspection configuration scope configuration. Network Firewall will begin SSL/TLS decryption and inspection for new connections to the firewall.

Changes to firewall engine rules and IPS engine rules are applied only to new traffic flows. Traffic flows that are already established keep the verdict that they were given. Other firewall changes are applied to all network packets. 

Adding, removing, or changing rules doesn't interrupt established traffic flows. Changing a policy's firewall default action or policy mode, or associating a firewall with a policy of the other type (a classic firewall policy instead of a Next Generation policy, or the reverse), restarts stateful inspection for the firewall. This interrupts the firewall's established traffic flows, and open connections can be reset.