A Cloud Firewall shows what it is doing on its Overview tab and reports every service on its Logs tab. This is where to look when a change does not take.
Status
The header shows the firewall's state:
| Status | Meaning |
|---|---|
| Not provisioned yet | Created, but not yet built. Attach a network and provision |
| Provisioning | Being built or reconfigured |
| Running | Online and serving traffic |
| Deleting | Being torn down |
| Needs attention | The guest is up but a setting did not apply. See the Logs tab |
Saved settings versus live settings
What you save is the firewall's intended configuration. LayerOne applies it to the guest for you:
- A network change rebuilds the firewall's attachments and can briefly restart the guest.
- A rule, port forward, DHCP or VPN change is pushed to the running firewall in one step.
- A load-balancer change reloads the routes without a restart.
If the guest is online but a setting could not be applied, the firewall goes to Needs attention rather than pretending the change is live, and a banner explains that the last action could not be completed. Your intended settings are kept, so you can fix the cause and apply again.
The Logs tab
The Logs tab shows, per service, whether its last change applied and whether it is running: the firewall itself, DHCP, the load balancer, WireGuard and Tailscale. Below that are the live logs for each, so you can see why something failed, for example a certificate that cannot be issued because a domain does not yet point at the firewall.
Common things to check
A new domain has no certificate yet
HTTPS is issued only once the domain's DNS points at the firewall's public address. Set the A record, then give it a few minutes. See The load balancer.
Inbound traffic is not arriving
Inbound is blocked by default. Check that you have both the route or port forward and an Allow rule for it.
A workload has no internet
Confirm NAT masquerade is on, and that the workload's gateway is the firewall's address on the network.
If a firewall stays in Needs attention after you have fixed the obvious cause, select Reprovision in the header, or open a ticket.