Create a firewall

Create a firewall in your current project, in one of your VPCs, with one of your reserved IPs as its public address. It reaches Running by itself, and E2E emails you its sign-in details. For a shorter first run on an hourly plan, see Get started with Firewall.

Before you begin

• Your account can pay for the firewall. A prepaid account needs enough infra credits for about 24 hours of the plan, or for the plan’s minimum billing amount if that is higher. For a committed plan, the full price for the term is deducted at once. A postpaid account needs an approved postpaid request.
• You have an Active VPC in the region you will use, or you create one from the form. See Create a VPC.
• You have a reserved IP with the status Available in this project, or you reserve one from the form. See Reserve an IP.
• Your role in the project lets you create firewalls. To create a VPC from the form, your role also needs to create VPCs.

Firewall is available in Delhi and Chennai, with the same eight plans in each. Switch to the right project and region in MyAccount first: the firewall is created there, and it stays in that project, account, and region. To have a firewall somewhere else, create a new one there.

What it costs

Every plan offers hourly billing and one committed term of 30 days.

On hourly billing, you pay the plan’s hourly rate from the time the firewall first reaches Running until you delete it, including while it is powered off. Prepaid accounts pay from infra credits, and postpaid accounts pay on the monthly invoice.

The 30-day committed term costs less than the same time at the hourly rate. You pay its full price when you create the firewall, deducted from infra credits on a prepaid account or added to the next invoice on a postpaid account. If you delete the firewall before the term ends, the charges stay as they are, with no refund.

Each month you pay whichever is larger: the firewall’s hourly usage, or the plan’s minimum billing amount. On a prepaid account, MyAccount takes the minimum billing amount from your infra credits when you create the firewall and again on the first day of each month. The firewall’s hourly usage counts against that amount.

The reserved IP that serves as the firewall’s public IP has its own monthly charge for as long as it is reserved. It stays reserved and billed after you delete the firewall, until you delete the IP. A new VPC is billed separately too.

The FortiGate licence and its service package are part of the plan price. The rates are on the plan table, and on the E2E pricing page.

Choose a plan

1. In MyAccount, under Network, click Firewall. If you have no firewall yet, click Get Started. Manage Firewall opens.
2. Click Add New Firewall. Create Firewall Appliance opens with the list of plans.
3. Compare the plans. The table shows Plan, CPU, IOPS, RAM, Storage, and Price. Price is the hourly rate with the monthly rate beside it, in Rs. or USD by your account’s currency. To narrow the list, use All vCPU, All RAM, and All Storage. Reset clears them.
4. Choose the plan you want, by its row or its Select button. Its details open: vCPU, RAM, storage, operating system, series, and plan name.

Each plan comes with one Fortinet service package, and the end of the plan name shows which: FC for FortiCare Premium only, ATP for Advanced Threat Protection, UTP for Unified Threat Protection, and ENTP for Enterprise Protection. Pick the plan whose size and package fit. You can move to a bigger plan or another package later with Upgrade Firewall Plan. The new plan has at least the vCPU and RAM of the current one. The packages are compared in Plans and service packages.

Choose hourly or committed billing

Every plan shows —Choose Billing Type– with two choices:

• Hourly Billed charges by the minute at the hourly price. Take it to try the firewall out, or for a firewall you will delete within 30 days.
• 30 Days Committed reserves the firewall for 30 days at a lower price. Take it for a firewall you will keep for the whole term. Prepaid accounts see the price in Infra Credit Point.

Then click Create. The create form opens.

Fill in the form

The form, also titled Create Firewall Appliance, shows Selected Plan with the plan and its price per hour, excluding GST, or the plan and its committed term.

When they apply, it also shows:

• Minimum Billing: The minimum monthly billing of Rs. applies immediately on creation of firewall and subsequently on the first day of every calendar month. On a prepaid account, this amount comes from your infra credits.
• Committed Node, for a committed term: when the term ends, and when its cost is charged. On a postpaid account, the cost is added to the next invoice. On a prepaid account, it is deducted from infra credits at launch.

Then:

1. In Your Firewall name, keep the name that starts with Firewall-, or type your own: up to 50 characters of letters, digits, underscores, and hyphens. Any other character shows Only letters, digits, underscore or hyphen are allowed.
2. Under Network, in Select VPC, choose an Active VPC. The firewall gets a private IP in it.
   • To make one without leaving the page, click Create New VPC, then refresh the list.
   • With no VPC, the form reads You do not have a VPC.
3. In Select IP, choose a reserved IP from this project as the firewall’s public IP. Pick it with care: the firewall keeps it for as long as it exists. For another public address later, attach a second reserved IP as an Add-on IP.
   • Choose an IP without (This IP is already attached) or (This IP is a Floating IP) beside it.
   • To reserve one without leaving the page, click Reserve New IP. It is billed monthly from when you reserve it.
   • With none, the form reads You do not have a reserve IP.
4. Click Create My Firewall. The button turns on once the name is valid and you have picked a VPC and a reserved IP.

The FortiGate’s own policies control the firewall’s traffic. Set them after you sign in.

Confirm a committed firewall

With hourly billing, Create My Firewall creates the firewall at once.

With a committed term, Committed Firewall Confirmation opens first:

1. Turn on the checkbox to agree that the full cost for the term is billed, or deducted from infra credits, and that deleting the firewall early gives no refund for the days left.

2. Choose what happens when the term ends:

   • Auto-renew the committed plan: , the default, starts another term of the same length.
   • Switch to hourly billing at the base rate of Rs. per month. moves the firewall to hourly billing.

   Keep auto-renew for a firewall you will keep. Switch to hourly if you plan to delete it after the term.

3. Click Proceed.

After the firewall is created, the choice is shown under Committed Firewall Settings on Firewall Detail, and it applies from the term’s end date.

If MyAccount refuses to create the firewall

If one of these messages shows, the firewall is not created yet:

• Low Infra Credits Balance: a prepaid account is short of infra credits. It needs enough for about 24 hours of the plan, or the plan’s minimum billing amount if that is higher. The dialog says how many more you need. Add infra credits and create the firewall again.
• We received your request to postpaid account and working on it. We will soon notify you through an email.: your postpaid request is still being reviewed. Create the firewall once it is approved.
• Failed to create the Firewall Appliance. Please try later.: E2E could not get a FortiGate licence for the new firewall. Nothing is created and nothing is charged. Try again later.

For help with any message, see MyAccount refuses to create the firewall.

Watch it reach Running

Manage Firewall opens with Firewall Creation is in progress., and the new firewall reads Creating, and the status updates by itself. A new firewall usually reaches Running within a few minutes, and the FortiGate’s screen opens about two minutes after that. When the firewall leaves Creating, Firewall started Successfully shows, and Status reads Running.

Check the new firewall

On Manage Firewall, the new firewall’s row shows its Plan, Private IP, Public IP, and Status Running. Manage Firewall lists the firewalls of the current project in the selected region, apart from your nodes, and your account’s node count leaves them out. You can create as many firewalls as you need; MyAccount sets no limit on the number of firewalls in a project or account.

Click the firewall to see its details below the list, in two tabs:

• Firewall Detail shows its Firewall Name, Firewall Plan, Configuration (RAM, vCPU, and storage), Created On, and its price. An hourly firewall shows Price, the hourly rate with the monthly rate beside it, in your account’s currency. A committed firewall shows Active Committed Plan, Committed Period End On, and Committed Firewall Settings in place of Price.
• Network shows its Public IPv4, its Add-on IPs under Addon IPv4, and its VPCs under Associated VPC name.

When the firewall first runs, E2E emails its sign-in details to you, with the account owner copied. The email, Congratulations on launching Fortinet Firewall Appliance, gives the username admin, a password link that works for seven days, and the address of the FortiGate’s screen.

Next, open the password link in the launch email, and sign in to the FortiGate to set the firewall’s policies. See Sign in to the FortiGate. To create firewalls from a script, see Create Firewall in the API reference.