---
title: "Add a public IP to a firewall"
description: "Give an E2E Firewall a second public IPv4 address by attaching a reserved IP as an Add-on IP from Manage Reserved IP, and detach it again."
content_type: "how-to"
product: "firewall"
platform: "MyAccount"
url: "/myaccount/firewall/how-to/add-a-public-ip-to-a-firewall/"
topic: ["network"]
relationships: {"requires":["/myaccount/reserved-ip/how-to/reserve-an-ip/"]}
---

# Add a public IP to a firewall

<!-- cspell:ignore FortiGate -->

Give a firewall a second public IP, an Add-on IP, for example for a second service behind the
firewall. The firewall also keeps its own public IP, the reserved IP you picked when you created it,
for as long as it exists.

## Before you begin

- You have a reserved IP with the status **Available**. See
  [Reserve an IP](/myaccount/reserved-ip/how-to/reserve-an-ip/). A reserved IP is billed monthly
  for as long as it is reserved. Your account can hold up to 10 reserved IPs. For more, see
  [Request a higher reserved IP limit](/myaccount/reserved-ip/how-to/request-a-higher-reserved-ip-limit/).
- The reserved IP is on the same network as the firewall's public IP. MyAccount checks this when
  you pick the firewall.
- The reserved IP is a regular reserved IP rather than a Floating IP. A Floating IP attaches only
  to nodes.
- The firewall is unlocked. To remove a lock, see [Lock a firewall](/myaccount/firewall/how-to/lock-a-firewall/).

## Attach the IP

1. In MyAccount, under **Network**, click **Reserve IP**. **Manage Reserved IP** opens.
2. In the row of an **Available** reserved IP, click **Actions**, then **Attach IP**.
3. Under **Select Product**, choose **Firewall**.
4. Under **Select Resource**, choose the firewall.
5. Click **Attach IP**.

**IP assigned Successfully.** shows. The IP's status changes to **Attached**, and the firewall's
name appears under **Assigned To**.

If one of these shows instead, the IP is not attached yet:

| Message                                                                                                          | What to do                                                                                                                             |
| ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **You selected reserved IP <ip> cannot be attached to resource <ip> because both belong to different networks.** | The reserved IP is on a different network from the firewall's public IP, and **Attach IP** stays greyed out. Pick another reserved IP. |
| **To attach Addon IP, you need to unlock the node.**                                                             | The firewall is locked. Choose **Unlock Firewall** in its **Actions**, then attach again.                                              |

For help with either message, see
[I cannot attach a reserved IP to my firewall](/myaccount/firewall/troubleshooting/firewall/#i-cannot-attach-a-reserved-ip-to-my-firewall)
and, for a locked firewall, the matching entry in
[Troubleshooting Firewall](/myaccount/firewall/troubleshooting/firewall/#to-attach-addon-ip-you-need-to-unlock-the-node).

## Check the Add-on IP

On **Manage Firewall**, click the firewall, then its **Network** tab. **Addon IPv4** lists the new
address. If there are more than two, click **View more**.

## Detach the Add-on IP

Detach the Add-on IP while the firewall is **Running** or **Powered off**, and unlocked. On a
locked firewall, the detach is refused with
**Reserve IP cannot be detached, Node is in locked state.**

1. In MyAccount, under **Network**, click **Reserve IP**.
2. In the IP's row, click **Actions**, then **Detach IP**, and confirm.

**IP Detached Successfully.** shows, and the IP returns to **Available**. It stays reserved in your
account, and billed, until you delete
it. See [Delete a reserved IP](/myaccount/reserved-ip/how-to/delete-a-reserved-ip/).

The firewall's own public IP, under **Public IPv4**, stays with the firewall because its licence
is tied to that address. Trying to detach it shows **The fortinet firewall license activated on
the public IP of the node so you can not detach public IP from this node.**

The new address shows under **Addon IPv4** on the firewall's details.

For the same steps from the reserved IP's side, see
[Attach a reserved IP as an Add-on IP](/myaccount/reserved-ip/how-to/attach-a-reserved-ip-as-an-add-on-ip/).