E2E CloudFirewall
E2E Firewall is a FortiGate virtual firewall from Fortinet that E2E runs for you as a dedicated appliance, with its own vCPU, RAM, and disk. You create it in MyAccount, connect it to your VPCs, and give it one of your reserved IPs as its public address. From MyAccount you then start, power off, reboot, reinstall, upgrade, lock, and delete it.
You set firewall policies, routes, NAT rules that map public addresses to private ones, VPN
tunnels, and admin users on the FortiGate itself, from the FortiGate’s screen or its command line.
You open the screen in a browser at https://<public-ip>, where <public-ip> is the firewall’s
public IP, and sign in as admin.
Firewall is under Network in MyAccount, and its list page is Manage Firewall.
What you can do
Section titled “What you can do”- Create a firewall on hourly or committed billing, with a VPC and a reserved IP.
- Sign in to the FortiGate with the details from the launch email.
- Attach a VPC to a firewall, so one firewall controls the traffic between several networks.
- Detach a VPC from a firewall.
- Add a public IP to a firewall as an Add-on IP.
- Set up a site-to-site VPN to AWS.
- Set up a site-to-site VPN to Google Cloud.
- Connect two firewalls with an IPsec VPN.
- Start, power off, or reboot a firewall.
- Reinstall a firewall to put the FortiGate back to how it was at creation.
- Upgrade a firewall plan to more vCPU and RAM, or to another service package, without creating the firewall again.
- Rename a firewall.
- Lock a firewall so nobody powers it off, upgrades it, or deletes it by mistake.
- Turn on accidental protection for a firewall to block delete and reinstall.
- Open the firewall console inside MyAccount.
- Delete a firewall, and what happens to its public IP.
To create, list, or delete firewalls from a script, see Create Firewall, Firewall List, and Delete Firewall by Node ID in the MyAccount API reference.
Firewall or security group
Section titled “Firewall or security group”A firewall and a security group do different jobs:
- A security group is a set of rules that you attach to a node, a scale group, a Kubernetes cluster, a load balancer, or a DBaaS instance. It decides which traffic reaches that one resource. See Security Group.
- A firewall is an appliance that your traffic passes through. One firewall can sit in several VPCs and filter the traffic between them, the internet, and other networks, including site-to-site VPN tunnels to other clouds.
You control a firewall’s traffic with policies on the FortiGate, not with a security group.
To open or close a port inside one node instead, use the node’s own firewall. See Open or close a port with iptables, Open or close a port with firewalld, or Open a port in Windows Firewall.
Plans and service packages
Section titled “Plans and service packages”You pick a plan when you create the firewall, and the plan sets both the size and the Fortinet service package. The start of the name gives the size: FFVA.100V plans have 1 vCPU and 9 GB of RAM, and FFVA.200V plans have 2 vCPU and 18 GB of RAM, each with a 10 GB disk. The end of the name gives the package, so FFVA.100V_ATP has 1 vCPU, 9 GB of RAM, and Advanced Threat Protection:
| Package | Plan name ends in | What it adds |
|---|---|---|
| FortiCare Premium only | FC | Fortinet support only, with no extra security services |
| Advanced Threat Protection | ATP | Intrusion prevention, antivirus, application control, and cloud sandbox |
| Unified Threat Protection | UTP | Everything in Advanced Threat Protection, plus URL, DNS, and video filtering, and botnet protection |
| Enterprise Protection | ENTP | Everything in Unified Threat Protection, plus data loss prevention, inline AI malware prevention, and attack-surface and IoT visibility |
Every plan includes FortiCare Premium, Fortinet’s support plan. For the full list of what each package covers, see Fortinet’s FortiGate security bundles and the FortiGuard security services datasheet.
To move to a bigger plan or another package later, see Upgrade a firewall plan. For what a firewall costs and how it is billed, see How much does a firewall cost?.
What every firewall needs
Section titled “What every firewall needs”Every firewall is placed in a VPC and gets a private IP in it. You pick an Active VPC on the create form, or create one there, and you can attach more VPCs later. See VPC and How many VPCs can a firewall have?.
A firewall’s public IPv4 address is one of your reserved IPs. You pick it on the create form, or reserve one there. For another public address, attach a second reserved IP as an Add-on IP. See Reserved IP and Can I change the firewall’s public IP?.
Licensing
Section titled “Licensing”Each firewall comes with its own Fortinet licence. E2E provides it and loads it onto the FortiGate when the firewall is created, so there is no licence key for you to enter. The licence stays with the firewall through power off, start, reboot, reinstall, and upgrade. When you delete the firewall, its licence goes with it.
E2E keeps the licence valid as part of the service. Its status shows on the FortiGate’s screen, and if it ever reads invalid or expired, contact support. See The FortiGate shows its licence as invalid or expired.
Where to start
Section titled “Where to start”To create your first firewall and sign in to it, follow Get started with Firewall. For fixes, see Troubleshooting Firewall. For short answers, including billing, regions, and limits, see Firewall FAQ.
Related products
Section titled “Related products”- VPC: the private networks a firewall sits in. A firewall is how you connect a VPC to another cloud over a site-to-site VPN.
- Reserved IP: the public IP every firewall needs, and its Add-on IPs.
- Security Group: rules on one resource, for traffic that does not need a firewall.
- Node: the servers whose traffic you send through the firewall.