diff --git a/CHANGES.md b/CHANGES.md
index 4ca8dc3..d78d172 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -2,7 +2,8 @@
 
 ## 2.1.4 (not yet released)
 
-(nothing yet)
+- #49: `triton create ... --firewall` to enable [Cloud
+  Firewall](https://docs.joyent.com/public-cloud/network/firewall).
 
 
 ## 2.1.3
diff --git a/lib/do_create_instance.js b/lib/do_create_instance.js
index 90be33b..337de15 100644
--- a/lib/do_create_instance.js
+++ b/lib/do_create_instance.js
@@ -88,13 +88,20 @@ function do_create_instance(subcmd, opts, args, callback) {
                     function (net) { return net.id; })
             };
 
+            for (var i = 0; i < opts._order.length; i++) {
+                var opt = opts._order[i];
+                if (opt.key === 'firewall') {
+                    createOpts.firewall_enabled = opt.value;
+                }
+            }
+
             log.trace({dryRun: opts.dry_run, createOpts: createOpts},
                 'create-instance createOpts');
             ctx.start = Date.now();
             if (opts.dry_run) {
                 ctx.inst = {
                     id: 'beefbeef-4c0e-11e5-86cd-a7fd38d2a50b',
-                    name: 'm00'
+                    name: 'this-is-a-dry-run'
                 };
                 console.log('Creating instance %s (%s, %s@%s)',
                     ctx.inst.name, ctx.inst.id,
@@ -183,13 +190,19 @@ do_create_instance.options = [
         type: 'string',
         help: 'Instance name. If not given, a random one will be created.'
     },
+    {
+        // TODO: add boolNegationPrefix:'no-' when that cmdln pull is in
+        names: ['firewall'],
+        type: 'bool',
+        help: 'Enable Cloud Firewall on this instance. See ' +
+            '<https://docs.joyent.com/public-cloud/network/firewall>'
+    },
     // XXX arrayOfCommaSepString dashdash type
     //{
     //    names: ['networks', 'nets'],
     //    type: 'arrayOfCommaSepString',
     //    help: 'One or more (comma-separated) networks IDs.'
     //},
-    // XXX enable-firewall
     // XXX locality: near, far
     // XXX metadata, metadata-file
     // XXX script (user-script)