def METHOD_NAME(bastion, network, firewall_settings):
    """ Creates a firewall rule for the Bastion outbound SSH traffic. """
    from_bastion_rule = firewall_settings.get('sshFromBastion')
    if from_bastion_rule:
        bastion_target_tag = from_bastion_rule.get('tag')
        # Calculate the firewall rule's source tags.
        if 'sshToBastion' in firewall_settings:
            bastion_host_tags = [firewall_settings['sshToBastion']['tag']]
        else:
            # Fall back to the instance tags collection.
            bastion_host_tags = bastion['properties'].get('tags', {})
            bastion_host_tags = bastion_host_tags.get('items', [])
            if bastion_host_tags:
                bastion_host_tags = copy.deepcopy(bastion_host_tags)
            else:
                msg = 'To enable SSH traffic from the Bastion host, at least one network tag must be assigned to it.'  # pylint: disable=line-too-long
                raise ValueError(msg)
        rule_setup = {
            'name': from_bastion_rule['name'],
            'sourceTags': bastion_host_tags,
            'targetTags': [bastion_target_tag],
            'priority': from_bastion_rule.get('priority'),
            'network': network,
        }
        return get_ssh_firewall_rule(
            '{}-from'.format(bastion['name']),
            rule_setup,
            'sshFromBastionRuleName',
            'sshFromBastionRuleSelfLink'
        )
    return [], []