FAQ
Answers to common questions about FPT Cloud Native Firewall for L1 Support.
1. Firewall management
| # | Question | Answer |
|---|---|---|
| 1.1 | A firewall shows Failed after creation — what should I do? | There are two cases. If the record could not be created (temporary API error), a toast shows "System is busy. Please try again later." and no firewall appears — try again. If the record was created but infrastructure provisioning failed, the firewall shows status Failed: open the Actions (⋮) menu and choose Retry (returns to Creating) or Delete. Retry and Delete run immediately with no confirmation popup. |
| 1.2 | Why can't I select a VPC when creating a firewall? | A VPC is disabled when it already has a firewall ("Already has firewall: [name]"), its firewall is Failed ("Firewall creation failed: [name]. Retry or delete that firewall first."), or its firewall is being created ("Creating firewall: [name]. Please wait."). Only a VPC with at least one routed subnet is shown. Choosing a VPC that shares a network with an existing firewall shows "This network already has a firewall". |
| 1.3 | What is the difference between Integrated and Protected? | Integrated (blue): at least one VPC is integrated but no subnet is associated yet, so traffic is not actually protected. Protected (green): at least one subnet is successfully associated. When all subnets are dissociated, the firewall returns to Integrated. (The other two states are Creating and Failed.) |
| 1.4 | I lost connectivity after associating a subnet — why? | This is intentional and important to know beforehand. On association, a popup warns "All traffic will be denied by default until rules are configured." The firewall is deny-by-default: any traffic matching no rule is blocked. So the subnet has no connectivity until you configure Network Access Rules and Apply Policy. Firewall rules with a matching CIDR are applied automatically. You cannot associate two subnets with overlapping CIDRs. |
| 1.5 | What should I know about dissociating a subnet and deleting a firewall? | Dissociate subnet requires typing dissociate (lowercase); afterward the subnet is no longer protected and traffic returns to default network routing. Delete Firewall is available only when status is Failed and deletes immediately with no confirmation popup. While VPCs/subnets sync, a "Syncing VPCs & subnets" badge appears (refreshes every 15 seconds); a subnet being processed shows In Progress and is temporarily locked. |
2. Network access rules
| # | Question | Answer |
|---|---|---|
| 2.1 | I added/edited/deleted a rule but it has no effect — why? | Rule changes do not take effect immediately. Every Add/Edit/Delete only moves the rule to a pending state (Not Applied (Added) / (Edited) / (Deleted)) saved as a draft. The firewall enforces rules only after you click Apply Policy, which shows the number of pending changes. |
| 2.2 | When several rules match, which one applies? | Each rule has a unique Priority. The firewall evaluates from the lowest Priority first and stops at the first match (first match wins), applying that rule's action. It is deny-by-default: traffic matching no rule is blocked. Priority ranges from 1000 to 9999 and must be unique. |
| 2.3 | Why can't I add a new rule? | The Add Rule button is locked when there is no firewall ("No firewall available") or when the 100-rule limit is reached ("Cannot add rule. Maximum rule limit (100) reached."). |
| 2.4 | Why can't I edit Direction when editing a rule? | In the Edit popup, Direction is locked, because changing traffic direction would change the whole rule structure (Source/Destination/NAT). To change Direction, delete the rule and create a new one with the desired Direction. |
| 2.5 | Does Apply Policy disrupt traffic, and why do rules disappear after Apply? | Yes, it can affect traffic — the confirmation popup states "Network traffic may be affected immediately." and Apply/Add/Edit/Delete are locked while applying. If a rule fails to apply, it is not applied and no longer shown — you must recreate it. When rules fail, an Apply Failed icon lists them as [Priority]. [Rule name] - [Change type] failed. |
| 2.6 | Can I recover a deleted rule? | Deleting a rule is a soft delete: the rule moves to Not Applied (Deleted) and is only removed for real after Apply Policy. Before applying, you can Restore it. Deleting requires typing delete (lowercase). |
| 2.7 | A rule is Applied but does not block traffic — why? | Rules are evaluated on the firewall interface matching the associated subnet's CIDR. If the subnet was dissociated, the rule still exists but does not work. Check whether the related subnet is still associated with the firewall. |
3. IDS/IPS rules
| # | Question | Answer |
|---|---|---|
| 3.1 | How do I enable IDS/IPS for a firewall? | There is a required order shown across three states: (1) no subnet associated — "IDS/IPS cannot be enabled", you must associate a subnet first; (2) associated but IDS/IPS off — "IDS/IPS is disabled", click Enable IDS/IPS (with confirmation); (3) enabled — the rule file list loads (default fpt-managed.rules). Use Disable IDS/IPS to turn it off. If a subnet associate/dissociate is in progress, you get "Another operation is in progress. Please try again later." |
| 3.2 | What format must an IDS/IPS rule file use? | Suricata format ("Suricata-format rules. Max 10000 rules or 5MB"), .rules extension only, UTF-8 encoding, up to 10,000 rules or 5MB per file. Flow: click Import Rule → drag-drop or pick a file → the system parses and validates → on success it shows "[X] rules validated successfully. Ready to upload." and enables Import. |
| 3.3 | Why does importing a rule file fail? | The system validates in order and reports specific errors, for example "File is empty.", "Invalid file extension. Only .rules files are supported.", "File exceeds 5MB limit.", "Invalid file encoding. Only UTF-8 encoding is supported.", "Max 10,000 rules per file.", and SID errors such as "Line [N]: Duplicate SID detected..." or "Line [N]: SID already exists in another rule file." The most common cause is a duplicate SID (must be unique within a file and across imported files). |
4. Logs & dashboard
| # | Question | Answer |
|---|---|---|
| 4.1 | What does the dashboard show, and why does Top Traffic look empty? | The dashboard has 8 widgets: Top Traffic Sources, Top Traffic Destinations, Total Packets, Top Hit Rules, Network Throughput, Active Connections, CPU Usage, Memory Usage. Top Traffic Sources and Top Traffic Destinations default to the Deny filter (blocked traffic). If they look empty, there may simply be no blocked traffic — switch the dropdown to Allow. Filter by Time Range (Last 5 min to Last 7 days) and by firewall. |
| 4.2 | How do I read the logs? | Logs are a log stream (each log is one line of text), not a table with per-field columns. Two tabs: Network Access (traffic through the firewall) and IDS/IPS Events (attack detections in Suricata format). Both load the latest 100 logs (newest first) and lazy-load more as you scroll. There is Search (highlights matches), Time Range (default Last 5 minutes), a Firewall filter, and Sync (prepends new logs; "No new logs" when there are none). |
| 4.3 | The IDS/IPS Events tab is empty — why? | The IDS/IPS Events tab only has data when IDS/IPS is enabled on the firewall. If it is not enabled, there are no events — enable IDS/IPS first. When there are no valid events, it shows "No IDS/IPS events found". |
5. VPN Client-to-Site
| # | Question | Answer |
|---|---|---|
| 5.1 | What are a VPN Gateway and a VPN User, and should I choose IPsec or OpenVPN? | A VPN Gateway is a client-to-site VPN attached to a firewall that lets remote users securely reach resources in a VPC. Each gateway has a VPN Type (IPsec or OpenVPN), Accessible Subnets, a Client IP Pool, a Public Endpoint, and DNS Servers. A VPN User is an access account under a gateway. IPsec connects over UDP 500/4500 with Username + Password and a shared CA Certificate .crt; OpenVPN connects over UDP 1194 with a per-user .ovpn profile. Limits: 20 gateways per firewall, 100 users per gateway. |
| 5.2 | What do I need to create a VPN Gateway? | The firewall must have at least one associated subnet and fewer than 20 gateways. In the form: VPN Type (IPsec default or OpenVPN); Gateway Name (≤50 chars, letters/digits/-/_, unique in the firewall); Accessible Subnets (at least one associated subnet); DNS Servers (at least one valid IPv4, up to 2). Public Endpoint and Client IP Pool are assigned automatically. After creation the gateway is Creating, then Running after a few minutes. |
| 5.3 | Why can't I change the VPN Type after creation? | The VPN Type (IPsec/OpenVPN) is fixed after creation. Reconfigure (Edit) only allows changing Accessible Subnets and DNS Servers. If you picked the wrong type, delete the gateway and create a new one. |
| 5.4 | How do users connect to the VPN? | IPsec: the admin provides Username + Password (password shown only once at create/reset) and distributes the CA Certificate .crt (from the Details tab) to install in the OS Trusted Root store; users connect to the Public Endpoint over UDP 500/4500. OpenVPN: the admin downloads each user's .ovpn file (Download .ovpn on the Users tab) for the user to import into an OpenVPN client. User changes update the UI immediately but take a few minutes to apply on the backend. |
| 5.5 | The credential is shown only once — what if I lose it? | IPsec password is shown once ("Save it now. It is shown only once."), then masked as ********. If lost, use Reset Password to generate a new one (the user must update their VPN client). OpenVPN profile: use Regenerate to reissue the cert and .ovpn; the old cert is revoked and the user must re-import the new profile. |
| 5.6 | What should I know about deleting a VPN Gateway or User? | Delete Gateway warns "All active sessions will be disconnected and all users will lose access." and requires typing delete (lowercase); it cannot be undone. Delete User warns "This user will be deleted and their active sessions will be disconnected." Connected sessions drop after the backend applies the change (a few minutes). |
6. Access
| # | Question | Answer |
|---|---|---|
| 6.1 | What is the difference between the Admin and Member roles? | NGFW Admin can perform every action. NGFW Member can only view (firewalls, network access rules, IDS/IPS rule files, logs, dashboard) and can still Download rule files and use Sync/filters. Action buttons are hidden for Member — Create Firewall, Integrate VPC, Associate/Dissociate, Add/Edit/Delete/Clone/Restore rule, Apply Policy, Enable/Disable IDS/IPS, Import/Delete rule file. If you cannot see one of these buttons, you are likely a Member. |
7. Common errors
| # | Symptom | Common cause | Resolution |
|---|---|---|---|
| 7.1 | "System is busy. Please try again later." | Temporary backend error (load, save, apply) | Retry after a few moments |
| 7.2 | "No records found" | No matching data | Review the search/filter criteria |
| 7.3 | "Firewall is being updated. Please wait." | The firewall is updating | View only for now; wait until it finishes |
| 7.4 | "You don't have permissions to access" | No permission for the service | Contact your organization administrator. Note: if you can open the page but do not see an action button, that is the Member role, not an access error |