FortiGate API

Automatically enabled when you configure FortiGate permissions in your agent workflow.

What It Does

Find the client’s FortiCloud account, and its FortiGates in FortiGate Cloud
Report each FortiGate’s status, CPU and memory, firmware and upgrade path, HA, interfaces, SD-WAN and VPN tunnels
Report the FortiSwitches and FortiAPs each FortiGate manages, with their status and firmware
Report registrations, support contracts, FortiGuard services and licences that expire within a window, from FortiCloud Asset Management and each FortiGate
Read event, traffic and security logs, from the FortiGate’s memory or disk, its FortiAnalyzer, or FortiCloud
Check whether FortiGate Cloud backs up each FortiGate’s configuration, and list its saved revisions
Return firewall policies and the addresses and services they use, and add, change or remove them
Upgrade firmware from FortiGuard, and restart a FortiGate, FortiSwitch or FortiAP
Keep your PSA’s configuration items and renewal tickets in step with FortiCloud’s contracts

Neo reaches a FortiGate through FortiGate Cloud, over the management tunnel FortiGate Cloud keeps to it, so the FortiGate does not need to be reachable from the internet. A FortiGate that is not in FortiGate Cloud, or is offline, is out of reach for its own checks; its FortiCloud registrations and contracts still answer. Changes to a FortiGate through FortiGate Cloud need a paid FortiGate Cloud subscription.

How the agent handles a renewal report

The agent lists each client’s registered products in FortiCloud and the FortiGuard services on each FortiGate, then reports per client every contract, entitlement and service that ends within the window you asked for, with the serial, the model and the date. It names the products and clients it could not reach, so nothing is reported as fine without a check.

Permission Groups

Group	Access levels	Covers
Devices, Registrations and Contracts	Disabled, Read Only, Read / Write	FortiGates in FortiGate Cloud, FortiCloud registrations, entitlements, contracts and licences
Monitoring, Logs and Reports	Disabled, Read Only, Read / Write	Status, performance, logs (memory, disk, FortiAnalyzer, FortiCloud), FortiView, security rating, reports and automation
Firewall Policies and Objects	Disabled, Read Only, Read / Write	Firewall policies, addresses, services, schedules, VIPs, shapers, sessions, proxy and ZTNA rules
Security Profiles	Disabled, Read Only, Read / Write	Antivirus, IPS, web filter, application control, DNS filter, email filter, DLP, sandbox and threat feeds
VPN	Disabled, Read Only, Read / Write	IPsec and SSL VPN settings, tunnels and their status
Network, Wireless and Switching	Disabled, Read Only, Read / Write	Interfaces, zones, DHCP, DNS, routing, SD-WAN, HA, FortiSwitches and FortiAPs
Firmware, Restarts and Backups	Disabled, Read Only, Read / Write	Firmware and upgrade paths, FortiGuard updates, restarts, configuration revisions and backup settings
System Settings	Disabled, Read Only, Read / Write	Global settings, SNMP, NTP, replacement messages, Security Fabric and hardware settings
Users, Certificates and Administration	Disabled, Read Only, Read / Write	Users, user groups, authentication servers, FortiTokens, certificates, administrators, and FortiCloud accounts and organizational units

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read; monitoring and inventory writes	Every other write
IT Admin	Firmware, restart, VPN, network and system writes, and the Helpdesk writes	Policy, security profile and administration writes, and every write under Safety Controls
Full Automation	Every write except those below	Only the writes under Safety Controls

Safety Controls

Control	Behavior
Always ask	A write that sets a password, key or other secret, or changes a user’s two-factor sign-in; any change to an SNMP community, whose name is its community string; any change to the FortiGate’s administrator accounts, REST API users, their access profiles, single sign-on administrators and SAML sign-in; changing an administrator’s or user’s password; FortiToken changes; running a CLI script or storing one; any change to an automation stitch, trigger, condition, destination or action, and firing a stitch; shutting the FortiGate down; changing its VDOM mode or its private data encryption; a FortiSwitch factory reset; turning FortiGate Cloud management of a FortiGate on or off; decommissioning or transferring a registered product; and deleting an organizational unit. These always ask a technician, whatever the profile
Secrets	Every password, pre-shared key, shared secret, private key and SNMP community comes back as `[hidden by Neo]`. A write that leaves the field out keeps the stored value; a write that sends the marker back is refused, and so is a filter or sort on a hidden field
Deletes	A configuration change or delete must name one entry; a delete or change of a whole table, or one that selects entries with a filter or names several VDOMs, is refused. Before a change that sends a list, Neo reads the entry: when the field is a child table (BGP neighbors, OSPF interfaces and their keys, RADIUS accounting servers), the change is refused, whatever the list holds, because it would replace every entry and drop their hidden secrets; the agent changes one entry at a time. A list of references, such as a policy’s addresses, goes through. When the read fails, the change is not sent
Firmware	Only FortiGuard’s signed images: an upgrade from a file or a URL, without the signature check, or that formats the boot partition, is refused
Right client	On a ticket whose company is mapped to a FortiCloud account, every call must name that account, and every FortiGate or product it names must be in it. Calls that list or change every client’s account are refused on such a ticket
Refused	The FortiGate’s own FortiCloud and FortiCare sign-in, registration and deregistration; reads of a configuration backup, a saved revision’s file, certificate, debug and crash log downloads, licence files, a new API key or generated Wi-Fi keys; packet captures; file uploads; restoring a configuration, formatting the log disk, and any change to the FortiGate’s FortiGate Cloud or FortiManager management settings, which is how Neo reaches it. A read that answers a file instead of JSON is not passed on, apart from raw log lines

How to Configure

Connect FortiGate

Save your FortiCloud API user in the Neo Dashboard under the Networking integrations category. See Connecting FortiGate to Neo.

Configure permissions

On the agent’s Tools & Settings tab, click Networking and expand the FortiGate block. Pick one of its Presets, which are the access profiles above, or set each permission group yourself.

Start with Read Only. Health checks, renewal reports, logs and policy reviews need only reads. An agent that opens tickets or updates configuration items in your PSA needs the PSA tools too.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

How the agent handles a renewal report

Permission Groups

Access Profiles

Safety Controls

How to Configure

​What It Does

​How the agent handles a renewal report

​Permission Groups

​Access Profiles

​Safety Controls

​How to Configure

What It Does

How the agent handles a renewal report

Permission Groups

Access Profiles

Safety Controls

How to Configure