Deploying and managing dedicated firewalls

Last updated 1 Nov 2026

Overview

CloudPe Dedicated Firewalls provide enterprise-grade next-generation firewall (NGFW) appliances deployed directly in front of your private cloud networks. Unlike distributed Firewall rules (security groups) that operate at the virtual network interface level for basic port filtering, a dedicated firewall appliance delivers deep packet inspection, intrusion prevention (IPS), antivirus scanning, application control, and advanced VPN termination on a dedicated virtual appliance.

Each dedicated firewall is provisioned with a direct public WAN IP address and serves as the default gateway for a private protected network. CloudPe manages the underlying compute infrastructure, network plumbing, licensing, and automated nightly configuration backups, while you retain administrative control over firewall policies, routing objects, VPN tunnels, and security inspection rules through the FortiOS management interface.

Before you start

Viewing dedicated firewalls, plans, metrics, and activity requires the firewalls:read permission.
Deploying a new dedicated firewall appliance requires the firewalls:create permission.
Rebooting an appliance, reinstalling firmware configuration, or triggering manual backups requires the firewalls:update permission.
Terminating and deleting a dedicated firewall requires the firewalls:delete permission.
Revealing the one-time admin password, accessing the emergency recovery console, or downloading configuration backups requires the firewalls:manage permission.
The target cloud region must have dedicated firewall services enabled.
Ensure your project contains an eligible router-less private network or allow the deployment wizard to create a new protected network.

Steps

Deploy a dedicated firewall

In the sidebar, navigate to Dedicated Firewalls under NETWORK.
Select Create Firewall.
On the Plan & Sizing step, select your desired appliance size and security bundle from the plan matrix.
Select Continue to move to the Protected Network step.
Choose whether to create a new private network or attach an existing router-less network:
- To create a new network, provide a network name and subnet CIDR block.
- To use an existing network, select it from the dropdown list and verify that the eligibility validation completes successfully.
Select Continue to proceed to the Details step.
Enter an appliance name, configure the hostname, and choose your preferred billing cycle by selecting Hourly or Monthly.
Select Continue to advance to Review & Deploy.
Review your configuration details and select Deploy Firewall.

Access the firewall management interface and retrieve credentials

From Dedicated Firewalls under NETWORK, select your firewall to open its detail view.
On the Overview tab, locate the Management & FortiOS GUI card.
Select Reveal Admin Password to view the generated administrative password. Copy the credentials immediately; CloudPe discards this password after reveal and does not store it.
Select Open FortiOS GUI to launch the appliance management console in a new browser window using your WAN public IP.
Sign in using the administrative username and the revealed password.

Manage backups and perform lifecycle actions

Open the firewall detail view and navigate across the tabs:
- On the Overview tab, select Reboot to restart the appliance, or select Reinstall to perform a factory reset or restore from a previous configuration backup.
- Switch to the Metrics tab to inspect CPU utilization, system memory consumption, active session counts, and network throughput across selectable windows (1h, 24h, 7d).
- Switch to the Backups tab to review automated nightly backups, or select Take Backup to capture an immediate configuration snapshot.
- On the Backups tab, select Download on any stored backup row to download the configuration archive.
To decommission an appliance, open the Overview tab, select Delete Firewall, choose whether to delete the associated private network, and confirm the deletion dialog.

API

Manage dedicated firewalls programmatically using the firewalls endpoints.

Method and path	Permission
`GET /api/v1/firewalls`	`firewalls:read`
`GET /api/v1/firewalls/plans`	`firewalls:read`
`POST /api/v1/firewalls`	`firewalls:create`
`GET /api/v1/firewalls/{firewall_id}`	`firewalls:read`
`DELETE /api/v1/firewalls/{firewall_id}`	`firewalls:delete`
`POST /api/v1/firewalls/{firewall_id}/credentials/reveal`	`firewalls:manage`
`GET /api/v1/firewalls/{firewall_id}/console`	`firewalls:manage`
`POST /api/v1/firewalls/{firewall_id}/actions/reboot`	`firewalls:update`
`POST /api/v1/firewalls/{firewall_id}/actions/reinstall`	`firewalls:update`
`GET /api/v1/firewalls/{id}/backups`	`firewalls:read`
`POST /api/v1/firewalls/{id}/actions/backup`	`firewalls:update`
`GET /api/v1/firewalls/{firewall_id}/backups/{backup_id}/download`	`firewalls:manage`
`GET /api/v1/firewalls/{id}/metrics`	`firewalls:read`
`POST /api/v1/firewalls/networks/validate`	`firewalls:read`

List deployed firewalls:

curl https://app.cloudpe.com/api/v1/firewalls \
  -H "Authorization: Bearer <API_KEY>"

List available firewall plans and pricing for a region:

curl "https://app.cloudpe.com/api/v1/firewalls/plans?region_id=<region_id>" \
  -H "Authorization: Bearer <API_KEY>"

Deploy a dedicated firewall with a new network:

curl -X POST https://app.cloudpe.com/api/v1/firewalls \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "edge-firewall",
        "hostname": "edge-firewall",
        "region_id": "<region_id>",
        "project_id": "<project_id>",
        "plan_slug": "<plan_slug>",
        "billing_cycle": "HOURLY",
        "network_mode": "new",
        "new_network_name": "protected-lan",
        "new_network_cidr": "10.20.0.0/24"
      }'

Reveal the administrative password:

curl -X POST https://app.cloudpe.com/api/v1/firewalls/<firewall_id>/credentials/reveal \
  -H "Authorization: Bearer <API_KEY>"

Trigger an emergency reboot:

curl -X POST https://app.cloudpe.com/api/v1/firewalls/<firewall_id>/actions/reboot \
  -H "Authorization: Bearer <API_KEY>"

Create a configuration backup:

curl -X POST https://app.cloudpe.com/api/v1/firewalls/<id>/actions/backup \
  -H "Authorization: Bearer <API_KEY>"

Limits & billing

Dedicated firewalls support both hourly pay-as-you-go metering and monthly committed subscriptions.
Appliance pricing includes compute resources, public WAN IPv4 address allocation, and the software security license bundle.
While a dedicated firewall is active, its attached protected network cannot be deleted or connected to a separate virtual router.
If a monthly renewal fails or an account enters payment hold, the public WAN interface is isolated while preserving internal configuration and protected network routing. Settling the outstanding balance restores external network traffic automatically.
Deleting a firewall closes active billing records immediately and releases the assigned public WAN IP address.

Troubleshooting

Message	What it means	What to do
`Region is not enabled for dedicated firewalls`	The selected region does not currently offer dedicated firewall appliances.	Choose an enabled cloud region or contact CloudPe support for regional roadmap availability.
`Firewall not found`	The requested firewall appliance ID does not exist or is outside the scope of the current project.	Verify that the correct project is selected in the project switcher.
`The password is still in use by provisioning — reveal it once the firewall is ACTIVE`	Administrative credentials cannot be retrieved while the initial deployment and licensing workflow is in progress.	Wait for the appliance status pill to transition to active before revealing credentials.
`Already revealed — use Reinstall for a new password or the console maintainer login`	The one-time administrative password was previously revealed and has been cleared from CloudPe storage.	Use the recovery console to perform a maintainer password reset, or trigger a reinstall to regenerate credentials.
`Firewall deletion is already in progress`	A deletion request has already been dispatched for this appliance.	Allow background teardown tasks to complete resource cleanup.

FAQ

How does a dedicated firewall differ from security groups? Firewall rules (security groups) provide hypervisor-level layer 4 stateful packet filtering for individual instances. Dedicated firewalls act as full next-generation security gateways with application inspection, threat prevention, antivirus, and central routing policies.

What responsibilities does CloudPe manage versus the customer? CloudPe manages appliance hosting, virtual hardware, network interfaces, public IP delivery, software licensing, and nightly backups. Customers manage security policies, routing objects, VPN tunnels, administrative accounts, and traffic rules inside the firewall operating system.

What should I do if I lose the administrative password after revealing it? Because CloudPe permanently discards the password after the initial reveal, you can open the recovery console to execute a password reset, or reinstall the appliance from a configuration backup to generate a new password.

Did this guide answer your question?If you need customized assistance with your deployment, reach out to our team.

Contact Support