Where can I find pricing information?

For the latest pricing information for licensed firewall offerings see License plan pricing.

Can I change my license plan after deployment?

No. The license plan is fixed at deployment time and cannot be changed on an existing instance. To use a different license plan, you must place a new order with the required plan, migrate your configuration to the new instance, and cancel the existing deployment. You are billed for both instances until the existing one is canceled. For more information, see Resizing a firewall virtual server instance.

Can I resize the virtual server instance without changing the license?

Yes. You can resize the underlying virtual server instance to a different profile without changing the license plan. The license and associated billing remain unchanged after a resize. Stop the instance before you resize it. For more information, see Resizing a firewall virtual server instance.

How is the FortiGate-VM license applied?

IBM applies the FortiGate-VM license automatically when your instance is provisioned. You do not need to upload or activate a license manually. The license is retrieved by cloud-init through the Instance Metadata Service during startup. To verify that the license is active, log in to the FortiGate web console and check the license status under System > FortiGuard. For information on how to access the FortiGate web console, see Accessing your FortiGate firewall.

What deployment configurations are available?

Three FortiGate PayGo catalog entries are available from the IBM Cloud catalog: a single virtual machine (VM), a high-availability (HA) pair in a single zone, and an HA pair across two zones. All three are Terraform-based deployable architectures that IBM deploys on your behalf through IBM Cloud Schematics. For more information about deploying through the catalog, see Deploying a licensed FortiGate firewall.

Who is responsible for applying FortiGate-VM software updates and security patches?

You are responsible for applying FortiGate-VM firmware updates and security patches to your virtual server instances. IBM notifies license holders of critical security advisories from the Fortinet PSIRT and coordinates with Fortinet TAC when needed, but does not modify customer FortiGate-VM configurations. For more information, see Keeping abreast of firmware updates and vulnerability patches.

How do I open a support case for a FortiGate-VM issue?

Open all FortiGate-VM support cases with IBM Support. IBM Support performs initial triage and opens a Fortinet Technical Assistance Center (TAC) case on your behalf when needed. Do not open TAC cases directly with Fortinet. For more information, including what details to include in your case, see Getting help and support.

Is the FortiGate-VM licensed firewall a managed service?

No. IBM provides license management and support coordination, but the FortiGate-VM licensed firewall is a customer-managed service. You are responsible for deploying, configuring, operating, and maintaining your FortiGate-VM instances. IBM does not configure or manage your firewall policies or network settings.

My target region is not listed in the Schematics workspace Location menu. Can I still deploy there?

Yes. The Location field in the catalog's Configure your workspace panel controls where the IBM Cloud Schematics workspace metadata and Terraform state are stored — it does not control where the FortiGate firewall is provisioned. IBM Cloud Schematics is available only in a subset of IBM Cloud regions (US and Europe). Regions such as br-sao (São Paulo), che-01 (Chennai), and in-che (Mumbai) are not supported as Schematics workspace locations.

To deploy into one of these regions, select any available Schematics workspace region and then set the REGION input variable further down the page to your intended deployment region. The Terraform automation uses the REGION variable to provision all FortiGate resources in the correct location. For a full list of supported Schematics regions, see IBM Cloud Schematics locations.

For guidance on deploying across multiple or unsupported regions, see Deploying resources in a specific region or across multiple regions.

Can I use IBM Cloud VPC snapshots to back up or restore my FortiGate-VM firewall?

No. VPC boot volume snapshots and whole-volume restores are not supported for FortiGate licensed firewall instances. Restoring a snapshot carries over the previous instance's FortiFlex license registration, which FortiOS cannot automatically refresh on the new instance, and bypasses the cloud-init and Terraform automation required to provision VPC networking resources and licensing properly. To back up and restore your firewall, export and import the FortiGate .conf configuration file. For more information, see Backing up and restoring the FortiGate configuration.