--- title: "Upgrade a firewall plan" description: "Move an E2E Firewall to a plan with more vCPU and RAM, or to another service package such as ATP, UTP, or Enterprise, with Upgrade Firewall Plan." content_type: "how-to" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/how-to/upgrade-a-firewall-plan/" topic: ["manage"] --- # Upgrade a firewall plan Move a firewall to a new plan: more vCPU and RAM, another Fortinet service package, or both. The firewall keeps its addresses, its VPCs, and the settings on its FortiGate. The plan sets the firewall's size and its package: FortiCare Premium only, Advanced Threat Protection, Unified Threat Protection, or Enterprise Protection. The packages are compared in [Plans and service packages](/myaccount/firewall/#plans-and-service-packages). ## Before you begin - The firewall is **Powered off**. While it runs, **Upgrade Firewall Plan** opens the notice **The firewall needs to be powered off before it can be upgraded.** See [Start, power off, or reboot a firewall](/myaccount/firewall/how-to/start-power-off-or-reboot-a-firewall/). Traffic through the firewall stops until the upgrade finishes. - The firewall is unlocked. See [Lock a firewall](/myaccount/firewall/how-to/lock-a-firewall/). - You have a backup of the FortiGate's configuration, saved from the FortiGate's screen. An upgrade keeps the settings, and the backup lets you restore the FortiGate's settings if the upgrade fails. - On a prepaid account, you have enough infra credits: for about 24 hours of the new plan, or, on a committed firewall, for the price difference for the rest of the term. ## What you can move to - On an hourly firewall, you can move to a plan with more vCPU and RAM. You can also keep the same vCPU and RAM and switch to any other service package. - On a committed firewall, you can move to a plan that costs the same or more for the same term. - An upgrade is one way: every later plan has at least the new vCPU and RAM. What you pay after upgrading: - On an hourly firewall, the new plan's hourly rate applies from the upgrade. - On a committed firewall, you pay the price difference between the two plans for the rest of the term. The term's end date stays the same. You pay the extra cost even if you delete the firewall before the term ends. ## Choose the new plan 1. In MyAccount, under **Network**, click **Firewall**. 2. On **Manage Firewall**, in the firewall's row, click **Actions**, then **Upgrade Firewall Plan**. **Upgrade Firewall Plan** opens. 3. Read **Current Configuration**: the firewall's **Plan**, **Disk**, **VCPU**, **Memory**, its **Price**, or **Committed Plan** and **Committed Until** for a committed firewall, and its **Operating System**. 4. Under **Available Upgrade Plans**, find the plan you want. The list shows each plan's **Plan**, **vCPU**, **Memory**, **Disk**, and **Price**, cheapest first. It lists every plan with at least your current vCPU and RAM, apart from your current plan. On a committed firewall, it shows only plans with the same or a higher hourly rate, priced for the same term. 5. Click **Upgrade** on that plan. If the list reads **No upgrade plan is currently available for this firewall.**, this firewall is already on the largest plan it can move to. ## Confirm the upgrade The **Upgrade Firewall Plan** dialog opens. Before you confirm: - Check the plan change and the price after upgrading. On an hourly firewall, it shows the new plan's hourly rate, with the monthly rate beside it, in **Rs.** or **USD** by your account's currency. On a committed firewall, the term keeps its end date, and you pay the extra cost even if you delete the firewall before then. - Keep the firewall powered off while it shows **Upgrading**. - Back up the firewall's configuration first. Then: 1. Turn on **I understand and want to upgrade the Firewall.** 2. Click **Upgrade**. **Firewall upgrade initiated** shows, **Manage Firewall** opens, and **Status** reads **Upgrading**. E2E changes the plan and then starts the firewall for you. When only the service package changes, the firewall is usually **Running** on the new plan about 10 seconds after the upgrade starts, and the FortiGate's screen opens about 35 seconds later. On a prepaid account that is short of infra credits, **Low Infra Credits Balance** opens instead, with **Upgrade not allowed.** and the number of infra credits you need. Add infra credits, or ask the person who adds infra credits to your account, then upgrade again. If one of these shows instead, the firewall stays on its plan: - **Firewall must be in powered off state to initiate an upgrade**: power the firewall off first. - **An upgrade is already in progress for this firewall**: wait for that upgrade to finish. - **New plan is identical to the current plan**: pick another plan. - **CPU downgrade is not permitted for firewall upgrades**: pick a plan with at least the current vCPU. - **The selected plan is no longer available for upgrade. Please refresh the page and choose a plan from the updated list.**: reload the page, and pick a plan from the new list. For help with any message, see [An upgrade is refused](/myaccount/firewall/troubleshooting/firewall/#an-upgrade-is-refused). ## Check the upgrade When the upgrade finishes, **Status** reads **Running** and **Firewall upgraded successfully** shows. E2E emails the account owner, with project members copied, and posts a **Firewall Upgraded** notification: **Your firewall has been upgraded successfully.** The email names the firewall, its public IP, the project, the previous and new plan, and the new hourly rate. On the firewall's **Firewall Detail** tab, **Firewall Plan** and **Configuration** show the new plan. If **Firewall Detail** still shows the old plan: 1. Wait a few minutes, and reload **Manage Firewall**. 2. If it still shows the old plan, reboot the firewall. See [Reboot the firewall](/myaccount/firewall/how-to/start-power-off-or-reboot-a-firewall/#reboot-the-firewall). 3. If it still shows the old plan after the reboot, contact support with the firewall's name and the plan you upgraded to. Once **Firewall upgraded successfully** has shown, the upgrade is done and only the display is behind, so there is no need to run the upgrade again. The FortiGate picks up a changed service package by itself within about an hour. To bring it in sooner, reboot the firewall, or run this on the FortiGate's command line: ```text execute update-now ``` If the FortiGate still shows the old service package an hour after the upgrade, contact support with the firewall's name and the plan. See [The FortiGate does not show my new service package. What can I try?](/myaccount/firewall/faq/#the-fortigate-does-not-show-my-new-service-package-what-can-i-try). If your firewall is an older one with a fixed licence, the upgrade moves it to E2E's current licensing, and the upgrade email carries a new licence token. Enter the token on the FortiGate yourself. See [I have an older firewall with a fixed licence. How do I enter the new licence token?](/myaccount/firewall/faq/#i-have-an-older-firewall-with-a-fixed-licence-how-do-i-enter-the-new-licence-token). Sign in to the FortiGate and check that its policies and tunnels work as before; see [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/). For help with an upgrade that does not finish, see [The firewall stays in Upgrading](/myaccount/firewall/troubleshooting/firewall/#the-firewall-stays-in-upgrading).