---
title: Firewall Actions
---

import { Play, Power, RotateCw, RefreshCcw, TrendingUp, Lock, Trash2, Terminal } from 'react-feather';

# Firewall Actions

Use this page to understand each firewall action in MyAccount, when it's available, and what to check before confirming.

Actions are available from the **Actions** menu next to each firewall in the list.

:::note
The action menu is not the final validator. The portal also checks the firewall's current status, lock state, and (for Upgrade Firewall Plan) billing and credit conditions before allowing an action to proceed. See [Action Availability](/docs/myaccount/network/firewall/manage/action-availability) for the full list of conditions.
:::

<QuickNav items={[
{ href: '#start', label: 'Start', icon: <Play size={13} /> },
{ href: '#power-off', label: 'Power Off', icon: <Power size={13} /> },
{ href: '#reboot', label: 'Reboot', icon: <RotateCw size={13} /> },
{ href: '#reinstall-firewall', label: 'Reinstall', icon: <RefreshCcw size={13} /> },
{ href: '#upgrade-firewall-plan', label: 'Upgrade Plan', icon: <TrendingUp size={13} /> },
{ href: '#lock-firewall-and-unlock-firewall', label: 'Lock / Unlock', icon: <Lock size={13} /> },
{ href: '#access-console', label: 'Access Console', icon: <Terminal size={13} /> },
{ href: '#delete', label: 'Delete', icon: <Trash2 size={13} />, destructive: true },
]} />

---

## Start

Use **Start** to power on a firewall that is currently powered off.

1. Click **Actions** next to the firewall in the list.
2. Select **Start**.

## Power Off

Use **Power Off** to shut the firewall down without deleting it. A powered-off firewall keeps its configuration, plan, and IP — it just stops passing traffic until you start it again.

1. Click **Actions** next to the firewall in the list.
2. Select **Power Off**.
3. A confirmation popup will appear — confirm to power off the firewall.

## Reboot

Use **Reboot** to restart the firewall without changing its configuration or plan. This is also the standard fix if your dashboard doesn't reflect a recent plan upgrade.

1. Click **Actions** next to the firewall in the list.
2. Select **Reboot**.
3. A confirmation popup will appear — confirm to reboot the firewall.

If your dashboard doesn't reflect a recent plan upgrade, a reboot is usually the fastest fix — see the [FAQ](/docs/myaccount/network/firewall/troubleshoot/faq) for details.

## Reinstall Firewall

Use **Reinstall** to wipe the firewall back to a fresh FortiOS install on the same appliance — for example, if its configuration has become unusable and you want to start over rather than delete and recreate it. Your plan, IP, and license stay the same; any manual configuration you made directly on the FortiGate is lost.

1. Click **Actions** next to the firewall in the list.
2. Select **Reinstall**.
3. A confirmation popup will appear — confirm to reinstall the firewall.

:::note
Your firewall's license and configuration are automatically restored after reinstall completes — no manual steps are needed.
:::

## Upgrade Firewall Plan

Use **Upgrade Firewall Plan** to move your firewall to a plan with more vCPU, RAM, or a different committed configuration.

**Before you start:** the firewall must be **Powered Off** to begin an upgrade. If the action is disabled, power off the firewall first.

To upgrade a firewall plan:

1. Power off the firewall if it isn't already.
2. Click **Actions** next to the firewall in the list and select **Upgrade Firewall Plan**.
3. Review **Current Configuration** at the top of the page — your existing Plan, Disk, VCPU, Memory, Price (or Active Committed Plan), Committed Until date (if applicable), and OS.
4. Choose a plan from **Available Upgrade Plans**. Your current plan, and any plan with less vCPU or RAM, never appear in this list. If your firewall is on a committed plan, plans priced lower than your current committed plan are also excluded — you cannot downgrade a committed firewall through this flow.
5. Click **Upgrade** on the plan you want.
6. Read the confirmation dialog carefully:
   - If your firewall is on a **committed** plan, the dialog confirms your existing committed period continues unchanged, and notes that any additional cost is non-refundable even if the firewall is later deleted.
   - If your firewall is billed **hourly**, the dialog shows the new plan's hourly rate along with its monthly equivalent, in your account currency.
   - The firewall must remain **powered off** until the upgrade completes — do not power it on while the status shows **Upgrading**.
   - Back up your firewall configuration before proceeding. If the upgrade fails, unbacked-up data or configuration may not be recoverable.
   - Once the new plan is applied, you cannot move to a lower configuration plan afterward. For firewalls that are not on a committed plan, the dialog also notes that your service bundle (ATP/UTP/Enterprise) can still be changed within the same configuration at any time.
7. Select the acknowledgement checkbox and click **Upgrade**.
8. Wait for the firewall status to return to **Running**.

:::note
Your dashboard reflects the upgraded plan automatically shortly after the upgrade completes. If it doesn't update right away, reboot the firewall — see the [FAQ](/docs/myaccount/network/firewall/troubleshoot/faq#my-dashboard-still-shows-the-old-plan-after-an-upgrade-what-should-i-do) for the full self-service sequence.
:::

Beyond what's filtered out of the plan list, a submitted upgrade request is also rejected if:

- The firewall is not powered off.
- The selected plan is identical to the current plan.
- The selected plan has fewer vCPUs than the current plan (CPU downgrades are not permitted).
- Another upgrade is already in progress for the same firewall.
- Your account is prepaid and does not have enough infra credit balance for the new plan — a **Low Credit Balance** dialog opens so you (or your MyAccount administrator, if you're a technical lead contact) can add credits.

## Lock Firewall and Unlock Firewall

Use **Lock Firewall** to protect it from other actions — for example, while you're in the middle of a maintenance window and want to prevent someone else on the team from powering it off, rebooting it, or upgrading its plan by mistake. Locking doesn't affect the firewall's running state; it only blocks other actions until you unlock it.

1. Click **Actions** next to the firewall in the list.
2. Select **Lock Firewall**.
3. A confirmation popup will appear — confirm to lock the firewall.

To unlock it again once you're ready to allow other actions:

1. Click **Actions** next to the firewall in the list.
2. Select **Unlock Firewall**.
3. Confirm to unlock the firewall.

## Access Console

Use **Access Console** to get direct GUI/CLI access to the FortiGate itself — this is where you configure actual firewall policies, traffic rules, VPN, and any other native FortiGate settings that MyAccount doesn't manage for you.

Console access to the firewall is not enabled by default, and is only visible to the firewall's owner. It is provisioned only on request.

1. Raise a request with E2E support to enable console access for your firewall.
2. Once enabled, click **Actions** next to the firewall in the list.
3. Select **Access Console**.
4. A console session will open, giving you direct access to the firewall.

## Delete

Use **Delete** to permanently remove the firewall appliance and free up its resources. Only do this once you're sure you no longer need it — there is no way to recover a deleted firewall or its configuration.

1. Click **Actions** next to the firewall in the list.
2. Select **Delete**.
3. A confirmation popup will appear — confirm to permanently delete the firewall.

:::warning
Deleting the firewall is irreversible. All associated configuration and licensing are released automatically — you do not need to manage them separately.
:::

:::note
If your firewall is still within an active committed period, the confirmation popup shows an additional warning: any remaining committed cost is non-refundable, even though the firewall is deleted before the committed period ends.
:::