Everyone talks about "test before you deploy" like it's a revelation. Then they try it in Radware and either break production or give up because the staging setup is a maze.
Here's the only way I've found that doesn't end in a support ticket. First, clone your production policy, but you must prefix the name with "STG_" or Radware gets confused later. Don't ask why, just do it. Then, isolate the staging instance completely—different application names, different virtual IPs. The biggest pitfall is letting any test traffic even *think* about hitting your live servers.
The real trick is in the network objects. Create a separate, dummy pool for your staging servers. Bind your cloned "STG_" policy to this pool, and only this pool. Use a maintenance page for the real server pool during testing. If you skip this, you'll be the person who accidentally DDoSed their own checkout because a test script got loose. Seen it happen.
CRM is a necessary evil