--- title: "Deploying and managing dedicated firewalls" slug: "dedicated-firewalls" source: "https://app.cloudpe.com/help/dedicated-firewalls" updated: "2026-11-01T08:58:55.054Z" --- # Deploying and managing dedicated firewalls ## Overview CloudPe Dedicated Firewalls provide enterprise-grade next-generation firewall (NGFW) appliances deployed directly in front of your private cloud networks. Unlike distributed [Firewall rules (security groups)](/help/security-groups-firewall) that operate at the virtual network interface level for basic port filtering, a dedicated firewall appliance delivers deep packet inspection, intrusion prevention (IPS), antivirus scanning, application control, and advanced VPN termination on a dedicated virtual appliance. Each dedicated firewall is provisioned with a direct public WAN IP address and serves as the default gateway for a private protected network. CloudPe manages the underlying compute infrastructure, network plumbing, licensing, and automated nightly configuration backups, while you retain administrative control over firewall policies, routing objects, VPN tunnels, and security inspection rules through the FortiOS management interface. ## Before you start - Viewing dedicated firewalls, plans, metrics, and activity requires the `firewalls:read` permission. - Deploying a new dedicated firewall appliance requires the `firewalls:create` permission. - Rebooting an appliance, reinstalling firmware configuration, or triggering manual backups requires the `firewalls:update` permission. - Terminating and deleting a dedicated firewall requires the `firewalls:delete` permission. - Revealing the one-time admin password, accessing the emergency recovery console, or downloading configuration backups requires the `firewalls:manage` permission. - The target cloud region must have dedicated firewall services enabled. - Ensure your project contains an eligible router-less private network or allow the deployment wizard to create a new protected network. ## Steps ### Deploy a dedicated firewall 1. In the sidebar, navigate to **Dedicated Firewalls** under **NETWORK**. 2. Select **Create Firewall**. 3. On the **Plan & Sizing** step, select your desired appliance size and security bundle from the plan matrix. 4. Select **Continue** to move to the **Protected Network** step. 5. Choose whether to create a new private network or attach an existing router-less network: - To create a new network, provide a network name and subnet CIDR block. - To use an existing network, select it from the dropdown list and verify that the eligibility validation completes successfully. 6. Select **Continue** to proceed to the **Details** step. 7. Enter an appliance name, configure the hostname, and choose your preferred billing cycle by selecting **Hourly** or **Monthly**. 8. Select **Continue** to advance to **Review & Deploy**. 9. Review your configuration details and select **Deploy Firewall**. ### Access the firewall management interface and retrieve credentials 1. From **Dedicated Firewalls** under **NETWORK**, select your firewall to open its detail view. 2. On the **Overview** tab, locate the **Management & FortiOS GUI** card. 3. Select **Reveal Admin Password** to view the generated administrative password. Copy the credentials immediately; CloudPe discards this password after reveal and does not store it. 4. Select **Open FortiOS GUI** to launch the appliance management console in a new browser window using your WAN public IP. 5. Sign in using the administrative username and the revealed password. ### Manage backups and perform lifecycle actions 1. Open the firewall detail view and navigate across the tabs: - On the **Overview** tab, select **Reboot** to restart the appliance, or select **Reinstall** to perform a factory reset or restore from a previous configuration backup. - Switch to the **Metrics** tab to inspect CPU utilization, system memory consumption, active session counts, and network throughput across selectable windows (**1h**, **24h**, **7d**). - Switch to the **Backups** tab to review automated nightly backups, or select **Take Backup** to capture an immediate configuration snapshot. - On the **Backups** tab, select **Download** on any stored backup row to download the configuration archive. 2. To decommission an appliance, open the **Overview** tab, select **Delete Firewall**, choose whether to delete the associated private network, and confirm the deletion dialog. ## API Manage dedicated firewalls programmatically using the firewalls endpoints. | Method and path | Permission | |---|---| | `GET /api/v1/firewalls` | `firewalls:read` | | `GET /api/v1/firewalls/plans` | `firewalls:read` | | `POST /api/v1/firewalls` | `firewalls:create` | | `GET /api/v1/firewalls/{firewall_id}` | `firewalls:read` | | `DELETE /api/v1/firewalls/{firewall_id}` | `firewalls:delete` | | `POST /api/v1/firewalls/{firewall_id}/credentials/reveal` | `firewalls:manage` | | `GET /api/v1/firewalls/{firewall_id}/console` | `firewalls:manage` | | `POST /api/v1/firewalls/{firewall_id}/actions/reboot` | `firewalls:update` | | `POST /api/v1/firewalls/{firewall_id}/actions/reinstall` | `firewalls:update` | | `GET /api/v1/firewalls/{id}/backups` | `firewalls:read` | | `POST /api/v1/firewalls/{id}/actions/backup` | `firewalls:update` | | `GET /api/v1/firewalls/{firewall_id}/backups/{backup_id}/download` | `firewalls:manage` | | `GET /api/v1/firewalls/{id}/metrics` | `firewalls:read` | | `POST /api/v1/firewalls/networks/validate` | `firewalls:read` | List deployed firewalls: ```bash curl https://app.cloudpe.com/api/v1/firewalls \ -H "Authorization: Bearer " ``` List available firewall plans and pricing for a region: ```bash curl "https://app.cloudpe.com/api/v1/firewalls/plans?region_id=" \ -H "Authorization: Bearer " ``` Deploy a dedicated firewall with a new network: ```bash curl -X POST https://app.cloudpe.com/api/v1/firewalls \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "name": "edge-firewall", "hostname": "edge-firewall", "region_id": "", "project_id": "", "plan_slug": "", "billing_cycle": "HOURLY", "network_mode": "new", "new_network_name": "protected-lan", "new_network_cidr": "10.20.0.0/24" }' ``` Reveal the administrative password: ```bash curl -X POST https://app.cloudpe.com/api/v1/firewalls//credentials/reveal \ -H "Authorization: Bearer " ``` Trigger an emergency reboot: ```bash curl -X POST https://app.cloudpe.com/api/v1/firewalls//actions/reboot \ -H "Authorization: Bearer " ``` Create a configuration backup: ```bash curl -X POST https://app.cloudpe.com/api/v1/firewalls//actions/backup \ -H "Authorization: Bearer " ``` ## Limits & billing - Dedicated firewalls support both hourly pay-as-you-go metering and monthly committed subscriptions. - Appliance pricing includes compute resources, public WAN IPv4 address allocation, and the software security license bundle. - While a dedicated firewall is active, its attached protected network cannot be deleted or connected to a separate virtual router. - If a monthly renewal fails or an account enters payment hold, the public WAN interface is isolated while preserving internal configuration and protected network routing. Settling the outstanding balance restores external network traffic automatically. - Deleting a firewall closes active billing records immediately and releases the assigned public WAN IP address. ## Troubleshooting | Message | What it means | What to do | |---|---|---| | `Region is not enabled for dedicated firewalls` | The selected region does not currently offer dedicated firewall appliances. | Choose an enabled cloud region or contact CloudPe support for regional roadmap availability. | | `Firewall not found` | The requested firewall appliance ID does not exist or is outside the scope of the current project. | Verify that the correct project is selected in the project switcher. | | `The password is still in use by provisioning — reveal it once the firewall is ACTIVE` | Administrative credentials cannot be retrieved while the initial deployment and licensing workflow is in progress. | Wait for the appliance status pill to transition to active before revealing credentials. | | `Already revealed — use Reinstall for a new password or the console maintainer login` | The one-time administrative password was previously revealed and has been cleared from CloudPe storage. | Use the recovery console to perform a maintainer password reset, or trigger a reinstall to regenerate credentials. | | `Firewall deletion is already in progress` | A deletion request has already been dispatched for this appliance. | Allow background teardown tasks to complete resource cleanup. | ## FAQ **How does a dedicated firewall differ from security groups?** [Firewall rules (security groups)](/help/security-groups-firewall) provide hypervisor-level layer 4 stateful packet filtering for individual instances. Dedicated firewalls act as full next-generation security gateways with application inspection, threat prevention, antivirus, and central routing policies. **What responsibilities does CloudPe manage versus the customer?** CloudPe manages appliance hosting, virtual hardware, network interfaces, public IP delivery, software licensing, and nightly backups. Customers manage security policies, routing objects, VPN tunnels, administrative accounts, and traffic rules inside the firewall operating system. **What should I do if I lose the administrative password after revealing it?** Because CloudPe permanently discards the password after the initial reveal, you can open the recovery console to execute a password reset, or reinstall the appliance from a configuration backup to generate a new password. ## Related - [Firewall rules (security groups)](/help/security-groups-firewall) - [VPC networks, subnets and routers](/help/vpc-networks-subnets) - [Floating IPs](/help/floating-ips-allocation)