Add a public IP to a firewall

Give a firewall a second public IP, an Add-on IP, for example for a second service behind the firewall. The firewall also keeps its own public IP, the reserved IP you picked when you created it, for as long as it exists.

Before you begin

• You have a reserved IP with the status Available. See Reserve an IP. A reserved IP is billed monthly for as long as it is reserved. Your account can hold up to 10 reserved IPs. For more, see Request a higher reserved IP limit.
• The reserved IP is on the same network as the firewall’s public IP. MyAccount checks this when you pick the firewall.
• The reserved IP is a regular reserved IP rather than a Floating IP. A Floating IP attaches only to nodes.
• The firewall is unlocked. To remove a lock, see Lock a firewall.

Attach the IP

1. In MyAccount, under Network, click Reserve IP. Manage Reserved IP opens.
2. In the row of an Available reserved IP, click Actions, then Attach IP.
3. Under Select Product, choose Firewall.
4. Under Select Resource, choose the firewall.
5. Click Attach IP.

IP assigned Successfully. shows. The IP’s status changes to Attached, and the firewall’s name appears under Assigned To.

If one of these shows instead, the IP is not attached yet:

Message	What to do
You selected reserved IP cannot be attached to resource because both belong to different networks.	The reserved IP is on a different network from the firewall’s public IP, and Attach IP stays greyed out. Pick another reserved IP.
To attach Addon IP, you need to unlock the node.	The firewall is locked. Choose Unlock Firewall in its Actions, then attach again.

For help with either message, see I cannot attach a reserved IP to my firewall and, for a locked firewall, the matching entry in Troubleshooting Firewall.

Check the Add-on IP

On Manage Firewall, click the firewall, then its Network tab. Addon IPv4 lists the new address. If there are more than two, click View more.

Detach the Add-on IP

Detach the Add-on IP while the firewall is Running or Powered off, and unlocked. On a locked firewall, the detach is refused with Reserve IP cannot be detached, Node is in locked state.

1. In MyAccount, under Network, click Reserve IP.
2. In the IP’s row, click Actions, then Detach IP, and confirm.

IP Detached Successfully. shows, and the IP returns to Available. It stays reserved in your account, and billed, until you delete it. See Delete a reserved IP.

The firewall’s own public IP, under Public IPv4, stays with the firewall because its licence is tied to that address. Trying to detach it shows The fortinet firewall license activated on the public IP of the node so you can not detach public IP from this node.

The new address shows under Addon IPv4 on the firewall’s details.

For the same steps from the reserved IP’s side, see Attach a reserved IP as an Add-on IP.