Reinstall a firewall

Reinstalling puts the FortiGate back to how it was when you created the firewall, on the same firewall. Use it to start over when the FortiGate’s configuration is no longer usable, without deleting the firewall and creating a new one.

After reinstalling, the firewall keeps:

• Its plan.
• Its public IP and its private IP.
• Its licence.
• Its VPCs and Add-on IPs.

Every setting you made on the FortiGate is erased: policies, routes, NAT, VPN tunnels, interfaces, and admin accounts. The admin password goes back to the one from the launch email, even if you changed it on the FortiGate.

Before you begin

• You have a backup of the FortiGate’s configuration, saved from the FortiGate’s screen, if you want any of it back.
• You still have the password from the launch email. The password link in the email works for seven days.
• The firewall is Running and unlocked. Reinstall Firewall is available only then. To remove a lock, see Lock a firewall.
• Accidental protection is off. While it is on, Reinstall OS reads This action cannot be performed while the accidental protection mode is enabled. See Turn on accidental protection for a firewall.

Reinstall the firewall

Reinstalling permanently erases every setting on the FortiGate. Back up the configuration first.

1. In MyAccount, under Network, click Firewall.
2. On Manage Firewall, in the firewall’s row, click Actions, then Reinstall Firewall.
3. Reinstall OS warns All data on this VM will be permanently deleted after re-installation. Turn on I understand the risk, and want to reinstall Operating system for the Node : .
4. Click Reinstall.

A message reads your reinstall action has commenced and it may take a while. The firewall powers off, starts again, and is reinstalled. Status shows Reinstalling until it is running. Traffic through the firewall stops until then. Reinstalling usually takes about two minutes, from when you click Reinstall until the FortiGate’s screen opens again.

On a powered-off firewall, the reinstall shows Failed to initiate the reinstall for the Firewall Appliance. Please try later. Start the firewall, then reinstall. If the firewall is Running and the message shows, try again later.

If reinstalling fails partway, the firewall goes back to the state it was in before, and E2E emails the account owner.

Check the reinstalled firewall

On Manage Firewall, Status reads Running. Then:

1. Sign in to the FortiGate at https://<public-ip> as admin, with the password from the launch email. If you use SSH, the FortiGate has a new SSH host key after a reinstall, so remove the old one from your SSH client’s known hosts first:

   ssh-keygen -R <public-ip>

   For a minute or two after the screen returns, SSH can refuse the password while the first configuration applies. Wait, then sign in again.

2. Check that the licence reads Valid on the FortiGate, in System > FortiGate VM License. If it is not, wait a few minutes, and check again.

3. Restore your configuration from the backup, or set the firewall up again.

If the licence still shows as not valid after a few minutes, see The FortiGate shows its licence as invalid or expired.

Change the admin password again, as at the first sign-in; see Sign in to the FortiGate. For help with any message, see Reinstalling the firewall fails.