--- title: "Firewall FAQ" description: "Short answers about E2E Firewall billing, regions, limits, security groups, public IPs, service packages, licences, VPCs, console access, and VPNs." content_type: "faq" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/faq/" --- # Firewall FAQ ## Do I need a firewall or a security group? Use a security group for one resource's ports, and a firewall to control traffic between networks. A security group is a set of rules you attach to one resource, such as a node or a load balancer, to decide which traffic reaches it. A firewall is a FortiGate appliance that your traffic passes through: it sits in your VPCs and filters traffic between them, the internet, and other networks, including site-to-site VPN tunnels. See [Firewall](/myaccount/firewall/) and [Security Group](/myaccount/security-group/). ## Does a firewall replace the firewall inside my node? No. A firewall inside a node, such as `ufw`, `iptables`, `firewalld`, or Windows Firewall, filters that node's own traffic and is separate from the Firewall product. See [Open or close a port with iptables](/myaccount/node/how-to/open-or-close-a-port-with-iptables/), [Open or close a port with firewalld](/myaccount/node/how-to/open-or-close-a-port-with-firewalld/), [Open a port in Windows Firewall](/myaccount/node/how-to/open-a-port-in-windows-firewall/), and [Do security group rules replace the firewall inside the node?](/myaccount/security-group/faq/#do-security-group-rules-replace-the-firewall-inside-the-node). ## Where do I set firewall rules, NAT, VPN, admin users, two-factor sign-in, and logs? On the FortiGate itself, from its screen at `https://` or from its command line. Routes are set there too. In MyAccount you create, start, power off, reboot, and delete the firewall, and change its VPCs, IPs, and plan. See [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/) and Fortinet's [FortiGate documentation](https://docs.fortinet.com/product/fortigate). ## Does E2E offer a site-to-site VPN? Yes, through Firewall. E2E runs the FortiGate for you, and you build and look after the tunnel on it yourself. Give the other side the firewall's public IP as the remote peer and your VPC's address range as the E2E network. Agree on a pre-shared key and the Phase 1 and Phase 2 settings, which must match on both sides. See [Set up a site-to-site VPN to AWS](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-aws/), [Set up a site-to-site VPN to Google Cloud](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/), and [Connect two firewalls with an IPsec VPN](/myaccount/firewall/how-to/connect-two-firewalls-with-an-ipsec-vpn/). ## Where do I find the admin username and password? In the launch email. When a new firewall first runs, E2E emails the person who created it, with the account owner copied, under **Congratulations on launching Fortinet Firewall Appliance**. The username is `admin`, and the password is a link that works for seven days. See [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/). ## Which IP does my firewall use? Its public IP is one of your reserved IPs, the one you pick under **Select IP** when you create it. It also gets a private IP in each of its VPCs. **Manage Firewall** shows both under **Public IP** and **Private IP**. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). ## Can I change the firewall's public IP? No. The firewall keeps the public IP it was created with for as long as it exists, because its licence is tied to that address. For another public address, attach a reserved IP as an Add-on IP, or create a new firewall with the reserved IP you want. See [Add a public IP to a firewall](/myaccount/firewall/how-to/add-a-public-ip-to-a-firewall/). ## Can I add a second public IP to a firewall? Yes. Attach an **Available** reserved IP as an Add-on IP from **Manage Reserved IP**, with **Attach IP** and **Select Product** set to **Firewall**. It must be on the same network as the firewall's public IP, and be a regular reserved IP rather than a Floating IP. See [Add a public IP to a firewall](/myaccount/firewall/how-to/add-a-public-ip-to-a-firewall/). ## Which service packages are there? Four, and each plan comes with one. The end of the plan name shows which, as in **FFVA.100V_ATP**: - Plans ending in FC have FortiCare Premium only, Fortinet's support plan, which every firewall has. - Plans ending in ATP have Advanced Threat Protection: intrusion prevention, antivirus, application control, and cloud sandbox. - Plans ending in UTP have Unified Threat Protection, which adds URL, DNS, and video filtering, and botnet protection. - Plans ending in ENTP have Enterprise Protection, which adds data loss prevention, inline AI malware prevention, and attack-surface and IoT visibility. See [Plans and service packages](/myaccount/firewall/#plans-and-service-packages) and Fortinet's [FortiGate security bundles](https://www.fortinet.com/support/support-services/fortiguard-security-subscriptions/fortigate-security-bundles). ## How do I change the service package? Power the firewall off and use **Upgrade Firewall Plan** in MyAccount. On an hourly firewall, you can move to another package on the same vCPU and RAM, higher or lower. On a committed firewall, you can move to a plan that costs the same or more. See [Upgrade a firewall plan](/myaccount/firewall/how-to/upgrade-a-firewall-plan/). ## How do I add vCPU or RAM to my firewall? Power the firewall off, then choose **Upgrade Firewall Plan** in its **Actions** menu and pick a bigger plan. Every plan in the list has at least the vCPU and RAM of the current one. A prepaid account needs infra credits for about 24 hours of the new plan, or, for a committed firewall, the price difference for the rest of the term. See [Upgrade a firewall plan](/myaccount/firewall/how-to/upgrade-a-firewall-plan/). ## The FortiGate does not show my new service package. What can I try? The FortiGate picks up a changed service package by itself within about an hour of the upgrade. To bring it in sooner, run this on the FortiGate's command line, or reboot the firewall from MyAccount: ```text execute update-now ``` The command updates the antivirus and IPS signatures and checks the licence, which can take a few minutes. If the FortiGate still shows the old service package an hour after the upgrade, contact support with the firewall's name and the plan. If **Firewall Detail** in MyAccount still shows the old plan, see [Firewall Detail still shows the old plan after an upgrade](/myaccount/firewall/troubleshooting/firewall/#firewall-detail-still-shows-the-old-plan-after-an-upgrade). ## Is the FortiGate licence included in the price? Yes. The licence and its service package are part of the plan price, with no separate licence charge. The reserved IP and any new VPC are billed on their own. See [How much does a firewall cost?](/myaccount/firewall/faq/#how-much-does-a-firewall-cost). ## Do I need to enter a licence key? No. E2E provides each firewall's licence and loads it onto the FortiGate when the firewall is created. It stays with the firewall through power off, start, reboot, reinstall, and upgrade. E2E keeps the licence valid as part of the service. Its status shows on the FortiGate's screen, not in MyAccount, and if it ever reads invalid or expired, contact support. See [Licensing](/myaccount/firewall/#licensing) and [The FortiGate shows its licence as invalid or expired](/myaccount/firewall/troubleshooting/firewall/#the-fortigate-shows-its-licence-as-invalid-or-expired). ## My FortiGate licence shows as expired. What do I do? Contact support, since E2E keeps the licence valid as part of the service. To read the licence, open **System** > **FortiGate VM License** on the FortiGate's screen, or run this on its command line and read the **License Status** line: ```text get system status ``` A valid licence reads **Valid**, with an expiry date. For what to send support, see [The FortiGate shows its licence as invalid or expired](/myaccount/firewall/troubleshooting/firewall/#the-fortigate-shows-its-licence-as-invalid-or-expired). ## I have an older firewall with a fixed licence. How do I enter the new licence token? An older firewall with a fixed licence moves to E2E's current licensing when you upgrade it, and the upgrade email carries the new licence token. You enter that token yourself, on the FortiGate's command line: ```text execute vm-license ``` Here `` is the token from the email. If the FortiGate reaches the internet through a proxy, add the proxy: ```text execute vm-license ``` Use only the token E2E sent you for this firewall, because a wrong token can leave the FortiGate's licence in a bad state. If you are unsure, contact support. For the full syntax, including retry options, see Fortinet's [Inject a FortiFlex license with the CLI](https://docs.fortinet.com/document/flex-vm/latest/administration-guide/116502/inject-a-fortiflex-license-with-the-cli). ## How many VPCs can a firewall have? Up to six, the one you pick when you create it included. You attach more on its **Network** tab, and it always keeps at least one. See [Attach a VPC to a firewall](/myaccount/firewall/how-to/attach-a-vpc-to-a-firewall/). ## Can I create a firewall without a VPC? No. Every firewall is placed in a VPC. Pick an **Active** VPC on the create form, or create one from the form. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). ## Can I move a firewall to another project? No. **Move To Another Project** is refused with **Resource is attached with vpc. Please detach it before transferring.** A firewall always keeps at least one VPC, so it stays in its project. To have a firewall in the other project, create a new one there. See [Move To Another Project is refused](/myaccount/firewall/troubleshooting/firewall/#move-to-another-project-is-refused). ## Can I move a firewall to another account or region? No. A firewall stays in the account and region where you create it; neither MyAccount nor support can move it. To have a firewall in another account or region, create a new firewall there. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/) and [Move To Another Project is refused](/myaccount/firewall/troubleshooting/firewall/#move-to-another-project-is-refused). ## Can I switch an hourly firewall to committed billing? No, not in MyAccount. You choose hourly or committed billing when you create the firewall, and every plan offers one committed term of 30 days. A committed firewall's renewal choice is also made at creation, and MyAccount keeps it as you set it. See [Choose hourly or committed billing](/myaccount/firewall/how-to/create-a-firewall/#choose-hourly-or-committed-billing). ## How do I get console access? Ask support to turn it on, giving the firewall's name. Once support turns it on, the account owner can open **Access Console** while the firewall is **Running**. See [Open the firewall console](/myaccount/firewall/how-to/open-the-firewall-console/). ## How long does creating a firewall take? A new firewall usually reaches **Running** within a few minutes, and the FortiGate's screen opens about two minutes after that. The firewall shows **Creating** until it runs, and then **Firewall started Successfully** appears. MyAccount gives no time estimate of its own. If it seems stuck, see [The firewall stays in Creating](/myaccount/firewall/troubleshooting/firewall/#the-firewall-stays-in-creating). ## How much does a firewall cost? You pay for the plan you pick. The rates are on the plan table in **Create Firewall Appliance**, and on the [E2E pricing page](https://www.e2enetworks.com/pricing). The FortiGate licence and its service package are part of the plan price. Every plan offers hourly billing and one committed term of 30 days. An hourly firewall is charged at its plan's hourly rate from the time it first reaches **Running** until you delete it. Every plan also has a minimum monthly billing amount, shown under **Minimum Billing** on the create form. Each month you pay whichever is larger: the firewall's hourly usage, or the minimum billing amount. On a prepaid account, MyAccount takes the minimum billing amount from your infra credits when you create the firewall and again on the first day of each month, and the firewall's hourly usage counts against that amount. Prepaid accounts pay from infra credits, and postpaid accounts pay on the monthly invoice. See [What it costs](/myaccount/firewall/how-to/create-a-firewall/#what-it-costs). ## What does the 30-day committed term cost? With the committed term, you reserve the firewall for 30 days at a lower price than the same time at the hourly rate. The full price for the term is charged when you create the firewall: deducted from infra credits on a prepaid account, or added to the next invoice on a postpaid account. You have then paid for the whole term, so if you delete the firewall before the term ends, the charges stay as they are, with no refund. See [Choose hourly or committed billing](/myaccount/firewall/how-to/create-a-firewall/#choose-hourly-or-committed-billing). ## Is the firewall's public IP billed separately? Yes. The reserved IP that serves as the firewall's public IP has its own monthly charge for as long as it is reserved. It stays reserved, and billed, after you delete the firewall. To stop paying for it, delete it on **Manage Reserved IP**. A new VPC is billed separately too. See [Delete the reserved IP](/myaccount/firewall/how-to/delete-a-firewall/#delete-the-reserved-ip). ## Is a powered-off firewall still billed? Yes. You pay for a firewall until you delete it, whether it is running or powered off. A powered-off firewall keeps its plan, addresses, VPCs, and FortiGate settings. It passes traffic again once you start it. See [Start, power off, or reboot a firewall](/myaccount/firewall/how-to/start-power-off-or-reboot-a-firewall/). ## What happens when I reinstall a firewall? The FortiGate goes back to how it was at creation. Every setting you made on it is erased, and the `admin` password goes back to the one from the launch email. The firewall keeps its plan, public and private IPs, and licence. Back up the configuration first. See [Reinstall a firewall](/myaccount/firewall/how-to/reinstall-a-firewall/). ## What happens when I delete a firewall? The firewall and every setting on its FortiGate are deleted permanently, and its billing stops. Its public IP stays reserved in your account, and billed, until you delete it on **Manage Reserved IP**. Its VPCs stay. On a committed firewall, the charges for the term stay as they are. See [Delete a firewall](/myaccount/firewall/how-to/delete-a-firewall/). ## How do I send my nodes' traffic through the firewall? Add a route on each node to the firewall's private IP, such as `sudo ip route add via dev ` on Linux, and allow the traffic with a policy on the FortiGate. See [Send a node's traffic through the firewall](/myaccount/firewall/how-to/sign-in-to-the-fortigate/#send-a-nodes-traffic-through-the-firewall). ## Which regions offer Firewall? Delhi and Chennai, with the same eight plans in each. A firewall goes in the project and region you have selected in MyAccount when you create it, and it stays there. **Manage Firewall** lists the firewalls of the current project in the selected region. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). ## How many firewalls can I create? As many as you need. MyAccount sets no limit on the number of firewalls in a project or account. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). ## Does a firewall count toward my node limit? No. Firewalls are listed on **Manage Firewall**, apart from your nodes, and your account's node count leaves them out. See [Check the new firewall](/myaccount/firewall/how-to/create-a-firewall/#check-the-new-firewall). ## Which permissions does my role need for a firewall? Your role's Firewall permissions decide what you see on **Manage Firewall**: create for **Add New Firewall**, update for most actions, and delete for **Delete Firewall**. Attaching or detaching a VPC needs both update and create. To get a missing permission, ask your account's administrator to change your role. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/) and [An item in the Actions menu is greyed out](/myaccount/firewall/troubleshooting/firewall/#an-item-in-the-actions-menu-is-greyed-out).