Firewall FAQ

Do I need a firewall or a security group?

Use a security group for one resource’s ports, and a firewall to control traffic between networks. A security group is a set of rules you attach to one resource, such as a node or a load balancer, to decide which traffic reaches it. A firewall is a FortiGate appliance that your traffic passes through: it sits in your VPCs and filters traffic between them, the internet, and other networks, including site-to-site VPN tunnels. See Firewall and Security Group.

Does a firewall replace the firewall inside my node?

No. A firewall inside a node, such as ufw, iptables, firewalld, or Windows Firewall, filters that node’s own traffic and is separate from the Firewall product. See Open or close a port with iptables, Open or close a port with firewalld, Open a port in Windows Firewall, and Do security group rules replace the firewall inside the node?.

Where do I set firewall rules, NAT, VPN, admin users, two-factor sign-in, and logs?

On the FortiGate itself, from its screen at https://<public-ip> or from its command line. Routes are set there too. In MyAccount you create, start, power off, reboot, and delete the firewall, and change its VPCs, IPs, and plan. See Sign in to the FortiGate and Fortinet’s FortiGate documentation.

Does E2E offer a site-to-site VPN?

Yes, through Firewall. E2E runs the FortiGate for you, and you build and look after the tunnel on it yourself. Give the other side the firewall’s public IP as the remote peer and your VPC’s address range as the E2E network. Agree on a pre-shared key and the Phase 1 and Phase 2 settings, which must match on both sides. See Set up a site-to-site VPN to AWS, Set up a site-to-site VPN to Google Cloud, and Connect two firewalls with an IPsec VPN.

Where do I find the admin username and password?

In the launch email. When a new firewall first runs, E2E emails the person who created it, with the account owner copied, under Congratulations on launching Fortinet Firewall Appliance. The username is admin, and the password is a link that works for seven days. See Sign in to the FortiGate.

Which IP does my firewall use?

Its public IP is one of your reserved IPs, the one you pick under Select IP when you create it. It also gets a private IP in each of its VPCs. Manage Firewall shows both under Public IP and Private IP. See Create a firewall.

Can I change the firewall’s public IP?

No. The firewall keeps the public IP it was created with for as long as it exists, because its licence is tied to that address. For another public address, attach a reserved IP as an Add-on IP, or create a new firewall with the reserved IP you want. See Add a public IP to a firewall.

Can I add a second public IP to a firewall?

Yes. Attach an Available reserved IP as an Add-on IP from Manage Reserved IP, with Attach IP and Select Product set to Firewall. It must be on the same network as the firewall’s public IP, and be a regular reserved IP rather than a Floating IP. See Add a public IP to a firewall.

Which service packages are there?

Four, and each plan comes with one. The end of the plan name shows which, as in FFVA.100V_ATP:

• Plans ending in FC have FortiCare Premium only, Fortinet’s support plan, which every firewall has.
• Plans ending in ATP have Advanced Threat Protection: intrusion prevention, antivirus, application control, and cloud sandbox.
• Plans ending in UTP have Unified Threat Protection, which adds URL, DNS, and video filtering, and botnet protection.
• Plans ending in ENTP have Enterprise Protection, which adds data loss prevention, inline AI malware prevention, and attack-surface and IoT visibility.

See Plans and service packages and Fortinet’s FortiGate security bundles.

How do I change the service package?

Power the firewall off and use Upgrade Firewall Plan in MyAccount. On an hourly firewall, you can move to another package on the same vCPU and RAM, higher or lower. On a committed firewall, you can move to a plan that costs the same or more. See Upgrade a firewall plan.

How do I add vCPU or RAM to my firewall?

Power the firewall off, then choose Upgrade Firewall Plan in its Actions menu and pick a bigger plan. Every plan in the list has at least the vCPU and RAM of the current one. A prepaid account needs infra credits for about 24 hours of the new plan, or, for a committed firewall, the price difference for the rest of the term. See Upgrade a firewall plan.

The FortiGate does not show my new service package. What can I try?

The FortiGate picks up a changed service package by itself within about an hour of the upgrade. To bring it in sooner, run this on the FortiGate’s command line, or reboot the firewall from MyAccount:

execute update-now

The command updates the antivirus and IPS signatures and checks the licence, which can take a few minutes. If the FortiGate still shows the old service package an hour after the upgrade, contact support with the firewall’s name and the plan.

If Firewall Detail in MyAccount still shows the old plan, see Firewall Detail still shows the old plan after an upgrade.

Is the FortiGate licence included in the price?

Yes. The licence and its service package are part of the plan price, with no separate licence charge. The reserved IP and any new VPC are billed on their own. See How much does a firewall cost?.

Do I need to enter a licence key?

No. E2E provides each firewall’s licence and loads it onto the FortiGate when the firewall is created. It stays with the firewall through power off, start, reboot, reinstall, and upgrade.

E2E keeps the licence valid as part of the service. Its status shows on the FortiGate’s screen, not in MyAccount, and if it ever reads invalid or expired, contact support. See Licensing and The FortiGate shows its licence as invalid or expired.

My FortiGate licence shows as expired. What do I do?

Contact support, since E2E keeps the licence valid as part of the service. To read the licence, open System > FortiGate VM License on the FortiGate’s screen, or run this on its command line and read the License Status line:

get system status

A valid licence reads Valid, with an expiry date. For what to send support, see The FortiGate shows its licence as invalid or expired.

I have an older firewall with a fixed licence. How do I enter the new licence token?

An older firewall with a fixed licence moves to E2E’s current licensing when you upgrade it, and the upgrade email carries the new licence token. You enter that token yourself, on the FortiGate’s command line:

execute vm-license <license-token>

Here <license-token> is the token from the email. If the FortiGate reaches the internet through a proxy, add the proxy:

execute vm-license <license-token> <proxy>

Use only the token E2E sent you for this firewall, because a wrong token can leave the FortiGate’s licence in a bad state. If you are unsure, contact support. For the full syntax, including retry options, see Fortinet’s Inject a FortiFlex license with the CLI.

How many VPCs can a firewall have?

Up to six, the one you pick when you create it included. You attach more on its Network tab, and it always keeps at least one. See Attach a VPC to a firewall.

Can I create a firewall without a VPC?

No. Every firewall is placed in a VPC. Pick an Active VPC on the create form, or create one from the form. See Create a firewall.

Can I move a firewall to another project?

No. Move To Another Project is refused with Resource is attached with vpc. Please detach it before transferring. A firewall always keeps at least one VPC, so it stays in its project. To have a firewall in the other project, create a new one there. See Move To Another Project is refused.

Can I move a firewall to another account or region?

No. A firewall stays in the account and region where you create it; neither MyAccount nor support can move it. To have a firewall in another account or region, create a new firewall there. See Create a firewall and Move To Another Project is refused.

Can I switch an hourly firewall to committed billing?

No, not in MyAccount. You choose hourly or committed billing when you create the firewall, and every plan offers one committed term of 30 days. A committed firewall’s renewal choice is also made at creation, and MyAccount keeps it as you set it. See Choose hourly or committed billing.

How do I get console access?

Ask support to turn it on, giving the firewall’s name. Once support turns it on, the account owner can open Access Console while the firewall is Running. See Open the firewall console.

How long does creating a firewall take?

A new firewall usually reaches Running within a few minutes, and the FortiGate’s screen opens about two minutes after that. The firewall shows Creating until it runs, and then Firewall started Successfully appears. MyAccount gives no time estimate of its own. If it seems stuck, see The firewall stays in Creating.

How much does a firewall cost?

You pay for the plan you pick. The rates are on the plan table in Create Firewall Appliance, and on the E2E pricing page. The FortiGate licence and its service package are part of the plan price.

Every plan offers hourly billing and one committed term of 30 days. An hourly firewall is charged at its plan’s hourly rate from the time it first reaches Running until you delete it.

Every plan also has a minimum monthly billing amount, shown under Minimum Billing on the create form. Each month you pay whichever is larger: the firewall’s hourly usage, or the minimum billing amount. On a prepaid account, MyAccount takes the minimum billing amount from your infra credits when you create the firewall and again on the first day of each month, and the firewall’s hourly usage counts against that amount.

Prepaid accounts pay from infra credits, and postpaid accounts pay on the monthly invoice. See What it costs.

What does the 30-day committed term cost?

With the committed term, you reserve the firewall for 30 days at a lower price than the same time at the hourly rate. The full price for the term is charged when you create the firewall: deducted from infra credits on a prepaid account, or added to the next invoice on a postpaid account. You have then paid for the whole term, so if you delete the firewall before the term ends, the charges stay as they are, with no refund. See Choose hourly or committed billing.

Is the firewall’s public IP billed separately?

Yes. The reserved IP that serves as the firewall’s public IP has its own monthly charge for as long as it is reserved. It stays reserved, and billed, after you delete the firewall. To stop paying for it, delete it on Manage Reserved IP. A new VPC is billed separately too. See Delete the reserved IP.

Is a powered-off firewall still billed?

Yes. You pay for a firewall until you delete it, whether it is running or powered off. A powered-off firewall keeps its plan, addresses, VPCs, and FortiGate settings. It passes traffic again once you start it. See Start, power off, or reboot a firewall.

What happens when I reinstall a firewall?

The FortiGate goes back to how it was at creation. Every setting you made on it is erased, and the admin password goes back to the one from the launch email. The firewall keeps its plan, public and private IPs, and licence. Back up the configuration first. See Reinstall a firewall.

What happens when I delete a firewall?

The firewall and every setting on its FortiGate are deleted permanently, and its billing stops. Its public IP stays reserved in your account, and billed, until you delete it on Manage Reserved IP. Its VPCs stay. On a committed firewall, the charges for the term stay as they are. See Delete a firewall.

How do I send my nodes’ traffic through the firewall?

Add a route on each node to the firewall’s private IP, such as sudo ip route add <remote-range> via <firewall-private-ip> dev <interface> on Linux, and allow the traffic with a policy on the FortiGate. See Send a node’s traffic through the firewall.

Which regions offer Firewall?

Delhi and Chennai, with the same eight plans in each. A firewall goes in the project and region you have selected in MyAccount when you create it, and it stays there. Manage Firewall lists the firewalls of the current project in the selected region. See Create a firewall.

How many firewalls can I create?

As many as you need. MyAccount sets no limit on the number of firewalls in a project or account. See Create a firewall.

Does a firewall count toward my node limit?

No. Firewalls are listed on Manage Firewall, apart from your nodes, and your account’s node count leaves them out. See Check the new firewall.

Which permissions does my role need for a firewall?

Your role’s Firewall permissions decide what you see on Manage Firewall: create for Add New Firewall, update for most actions, and delete for Delete Firewall. Attaching or detaching a VPC needs both update and create. To get a missing permission, ask your account’s administrator to change your role. See Create a firewall and An item in the Actions menu is greyed out.