--- title: "Firewall" description: "E2E Firewall is a dedicated FortiGate appliance from Fortinet that you create in MyAccount, place in your VPCs, and give a reserved public IP." content_type: "overview" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/" --- # Firewall E2E Firewall is a FortiGate virtual firewall from Fortinet that E2E runs for you as a dedicated appliance, with its own vCPU, RAM, and disk. You create it in MyAccount, connect it to your VPCs, and give it one of your reserved IPs as its public address. From MyAccount you then start, power off, reboot, reinstall, upgrade, lock, and delete it. You set firewall policies, routes, NAT rules that map public addresses to private ones, VPN tunnels, and admin users on the FortiGate itself, from the FortiGate's screen or its command line. You open the screen in a browser at `https://`, where `` is the firewall's public IP, and sign in as `admin`. Firewall is under **Network** in MyAccount, and its list page is **Manage Firewall**. ## What you can do - [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/) on hourly or committed billing, with a VPC and a reserved IP. - [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/) with the details from the launch email. - [Attach a VPC to a firewall](/myaccount/firewall/how-to/attach-a-vpc-to-a-firewall/), so one firewall controls the traffic between several networks. - [Detach a VPC from a firewall](/myaccount/firewall/how-to/detach-a-vpc-from-a-firewall/). - [Add a public IP to a firewall](/myaccount/firewall/how-to/add-a-public-ip-to-a-firewall/) as an Add-on IP. - [Set up a site-to-site VPN to AWS](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-aws/). - [Set up a site-to-site VPN to Google Cloud](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/). - [Connect two firewalls with an IPsec VPN](/myaccount/firewall/how-to/connect-two-firewalls-with-an-ipsec-vpn/). - [Start, power off, or reboot a firewall](/myaccount/firewall/how-to/start-power-off-or-reboot-a-firewall/). - [Reinstall a firewall](/myaccount/firewall/how-to/reinstall-a-firewall/) to put the FortiGate back to how it was at creation. - [Upgrade a firewall plan](/myaccount/firewall/how-to/upgrade-a-firewall-plan/) to more vCPU and RAM, or to another service package, without creating the firewall again. - [Rename a firewall](/myaccount/firewall/how-to/rename-a-firewall/). - [Lock a firewall](/myaccount/firewall/how-to/lock-a-firewall/) so nobody powers it off, upgrades it, or deletes it by mistake. - [Turn on accidental protection for a firewall](/myaccount/firewall/how-to/turn-on-accidental-protection-for-a-firewall/) to block delete and reinstall. - [Open the firewall console](/myaccount/firewall/how-to/open-the-firewall-console/) inside MyAccount. - [Delete a firewall](/myaccount/firewall/how-to/delete-a-firewall/), and what happens to its public IP. To create, list, or delete firewalls from a script, see [Create Firewall](/api/myaccount/operations/post-fortigate-create/), [Firewall List](/api/myaccount/operations/get-fortigate-list/), and [Delete Firewall by Node ID](/api/myaccount/operations/delete-nodes-firewall-id/) in the MyAccount API reference. ## Firewall or security group A firewall and a security group do different jobs: - A security group is a set of rules that you attach to a node, a scale group, a Kubernetes cluster, a load balancer, or a DBaaS instance. It decides which traffic reaches that one resource. See [Security Group](/myaccount/security-group/). - A firewall is an appliance that your traffic passes through. One firewall can sit in several VPCs and filter the traffic between them, the internet, and other networks, including site-to-site VPN tunnels to other clouds. You control a firewall's traffic with policies on the FortiGate, not with a security group. To open or close a port inside one node instead, use the node's own firewall. See [Open or close a port with iptables](/myaccount/node/how-to/open-or-close-a-port-with-iptables/), [Open or close a port with firewalld](/myaccount/node/how-to/open-or-close-a-port-with-firewalld/), or [Open a port in Windows Firewall](/myaccount/node/how-to/open-a-port-in-windows-firewall/). ## Plans and service packages You pick a plan when you create the firewall, and the plan sets both the size and the Fortinet service package. The start of the name gives the size: FFVA.100V plans have 1 vCPU and 9 GB of RAM, and FFVA.200V plans have 2 vCPU and 18 GB of RAM, each with a 10 GB disk. The end of the name gives the package, so **FFVA.100V_ATP** has 1 vCPU, 9 GB of RAM, and Advanced Threat Protection: | Package | Plan name ends in | What it adds | | -------------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | FortiCare Premium only | FC | Fortinet support only, with no extra security services | | Advanced Threat Protection | ATP | Intrusion prevention, antivirus, application control, and cloud sandbox | | Unified Threat Protection | UTP | Everything in Advanced Threat Protection, plus URL, DNS, and video filtering, and botnet protection | | Enterprise Protection | ENTP | Everything in Unified Threat Protection, plus data loss prevention, inline AI malware prevention, and attack-surface and IoT visibility | Every plan includes FortiCare Premium, Fortinet's support plan. For the full list of what each package covers, see Fortinet's [FortiGate security bundles](https://www.fortinet.com/support/support-services/fortiguard-security-subscriptions/fortigate-security-bundles) and the [FortiGuard security services datasheet](https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/og-fortiguard.pdf). To move to a bigger plan or another package later, see [Upgrade a firewall plan](/myaccount/firewall/how-to/upgrade-a-firewall-plan/). For what a firewall costs and how it is billed, see [How much does a firewall cost?](/myaccount/firewall/faq/#how-much-does-a-firewall-cost). ## What every firewall needs Every firewall is placed in a VPC and gets a private IP in it. You pick an **Active** VPC on the create form, or create one there, and you can attach more VPCs later. See [VPC](/myaccount/vpc/) and [How many VPCs can a firewall have?](/myaccount/firewall/faq/#how-many-vpcs-can-a-firewall-have). A firewall's public IPv4 address is one of your reserved IPs. You pick it on the create form, or reserve one there. For another public address, attach a second reserved IP as an Add-on IP. See [Reserved IP](/myaccount/reserved-ip/) and [Can I change the firewall's public IP?](/myaccount/firewall/faq/#can-i-change-the-firewalls-public-ip). ## Licensing Each firewall comes with its own Fortinet licence. E2E provides it and loads it onto the FortiGate when the firewall is created, so there is no licence key for you to enter. The licence stays with the firewall through power off, start, reboot, reinstall, and upgrade. When you delete the firewall, its licence goes with it. E2E keeps the licence valid as part of the service. Its status shows on the FortiGate's screen, and if it ever reads invalid or expired, contact support. See [The FortiGate shows its licence as invalid or expired](/myaccount/firewall/troubleshooting/firewall/#the-fortigate-shows-its-licence-as-invalid-or-expired). ## Where to start To create your first firewall and sign in to it, follow [Get started with Firewall](/myaccount/firewall/get-started/). For fixes, see [Troubleshooting Firewall](/myaccount/firewall/troubleshooting/firewall/). For short answers, including billing, regions, and limits, see [Firewall FAQ](/myaccount/firewall/faq/). ## Related products - [VPC](/myaccount/vpc/): the private networks a firewall sits in. A firewall is how you connect a VPC to another cloud over a site-to-site VPN. - [Reserved IP](/myaccount/reserved-ip/): the public IP every firewall needs, and its Add-on IPs. - [Security Group](/myaccount/security-group/): rules on one resource, for traffic that does not need a firewall. - [Node](/myaccount/node/): the servers whose traffic you send through the firewall.