FortiManager API

Automatically enabled when you configure FortiManager permissions in your agent workflow.

What It Does

Find the client’s ADOM, and its FortiGates with model, firmware, connection and sync status, HA and VDOMs
Ask a client’s own FortiGate, through FortiManager, how FortiGuard rates a website for it, and read its status, sessions, interfaces, VPN tunnels and logs
Find why a site was blocked: the policy, the web filter profile, its category actions and its URL filter
Allow or block a website in the client’s URL filter
Read and change policy packages, firewall policies, addresses, services and other objects, templates, and a FortiGate’s settings in FortiManager’s device database
Preview and install a policy package or a FortiGate’s settings, and report the install task per FortiGate
Report which FortiGates are out of sync with FortiManager, and upgrade a FortiGate’s firmware from FortiGuard

Neo changes a FortiGate’s configuration in FortiManager and installs it, never on the FortiGate directly. A change reaches the FortiGate when its install finishes.

How the agent handles a blocked website

The agent finds the client’s ADOM and the FortiGate the ticket is about, and asks that FortiGate how it rates the site, because FortiManager’s rating can differ from the FortiGate’s own. It reads the policy and web filter that apply, and reports the category and what blocked it. When asked to allow the site, it adds one entry to the profile’s URL filter, installs the policy package to that FortiGate, reads the install task, and reports what changed.

Permission Groups

Group	Access levels	Covers
Devices, ADOMs and Groups	Disabled, Read Only, Read / Write	ADOMs, managed FortiGates and their VDOMs and HA members, device groups and folders
Status, Tasks and Logs	Disabled, Read Only, Read / Write	FortiManager status, tasks, policy hit counts, package status, and a FortiGate’s own status, sessions and logs
Policy Packages, Firewall Policies and Objects	Disabled, Read Only, Read / Write	Policy packages, firewall policies, addresses, services, schedules, VIPs and their per-device mappings
Security Profiles and Web Filter	Disabled, Read Only, Read / Write	Web filter, URL filters, FortiGuard categories and local ratings, antivirus, IPS, application control, DNS filter and email filter
VPN	Disabled, Read Only, Read / Write	IPsec and SSL VPN settings, VPN Manager communities, and each tunnel’s status
Network, SD-WAN, Wireless and Switching	Disabled, Read Only, Read / Write	Interfaces and their per-device mappings, zones, routing, SD-WAN templates, DHCP, FortiSwitches and FortiAPs
Firmware, Revisions and Restarts	Disabled, Read Only, Read / Write	Firmware images and upgrades of managed FortiGates, configuration revisions, and a FortiGate’s restart
FortiGate System Settings and Templates	Disabled, Read Only, Read / Write	A FortiGate’s global settings in FortiManager’s device database, system templates, DNS, NTP, SNMP and replacement messages
Users, Certificates and Administration	Disabled, Read Only, Read / Write	Local and remote users, user groups, authentication servers, certificates and a FortiGate’s administrators
Installs, Scripts and Workspace	Disabled, Read Only, Read / Write	Installing policy packages and device settings to FortiGates, install previews, workspace locks and commits, CLI scripts and templates
Workflow Approvals	Disabled, Read Only, Read / Write	Approving or rejecting a workflow session in FortiManager’s workflow mode
FortiManager Settings	Disabled, Read Only, Read / Write	FortiManager’s own settings, FortiGuard distribution, metadata fields and ADOM options

In an ADOM in workspace mode, a change is wrapped in a lock and a commit. These steps need Read / Write on Installs, Scripts and Workspace and never ask on their own: each change follows its own group’s approval setting, and the install follows the Installs group’s.

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read; monitoring writes	Every other write and every install; workflow approvals and FortiManager’s settings stay read-only
IT Admin	Installs, firmware, VPN, network, system and inventory writes, and the Helpdesk writes	Policy, security profile, administration and FortiManager settings writes, and every write under Safety Controls
Full Automation	Every write except those below	Only the writes under Safety Controls

Safety Controls

Control	Behavior
Always ask	A write that sets a password, key or other secret, or changes a user’s two-factor sign-in; any change to FortiManager’s administrators, their profiles or how they sign in; a CLI script or CLI template, and running a script on FortiGates; deleting an ADOM or a policy package; removing a FortiGate from FortiManager, and replacing its serial number; restarting FortiManager, and upgrading an ADOM or FortiManager’s database; a firmware upgrade from an image that is not FortiGuard’s; and, on a FortiGate’s own configuration in FortiManager or through it, any change to its administrators, API users and their access profiles, its automation stitches, triggers and actions, its SNMP communities, a password or FortiToken change, and shutting it down. These always ask a technician, whatever the profile
Secrets	Every password, pre-shared key, shared secret, private key, encrypted value and SNMP community comes back as `[hidden by Neo]`. A write that leaves the field out keeps the stored value; a write that sends the marker back is refused, and so is a filter or sort on a hidden field
Whole records	Neo creates with `add` and changes only the fields it sends with `update`; FortiManager’s `set`, which replaces a whole record and would blank its hidden secrets, is refused. Before a change that sends a list, Neo reads the record: when the field is a child table (a URL filter’s entries, BGP neighbors), the change is refused, because it would replace every entry; the agent changes one entry at a time. When the read fails, the change is not sent
Deletes	A change or delete must name one entry; one on a whole table, or one that selects entries with a filter, is refused
FortiGate configuration	A FortiGate’s configuration is changed in FortiManager and installed; a configuration change sent to the FortiGate directly through FortiManager is refused. Any other action sent to a FortiGate through FortiManager names one FortiGate, never a group
Right client	On a ticket whose company is mapped to an ADOM, every call must name that ADOM, and every FortiGate or task it names must be in it. Writes to the global database every ADOM shares, and calls that reach every client or FortiManager itself, are refused on such a ticket
Refused	Sign-in and sign-out calls; FortiManager’s configuration backup and other file downloads; resetting FortiManager’s global database

How to Configure

Connect FortiManager

Save your FortiManager’s address and API key in the Neo Dashboard under the Networking integrations category. See Connecting FortiManager to Neo.

Configure permissions

On the agent’s Tools & Settings tab, click Networking and expand the FortiManager block. Pick one of its Presets, which are the access profiles above, or set each permission group yourself.

Start with Read Only. Checking a site’s category, finding why it was blocked and install reports need only reads. To allow a site, the agent needs Read / Write on Security Profiles and Web Filter and on Installs, Scripts and Workspace.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

How the agent handles a blocked website

Permission Groups

Access Profiles

Safety Controls

How to Configure

​What It Does

​How the agent handles a blocked website

​Permission Groups

​Access Profiles

​Safety Controls

​How to Configure

What It Does

How the agent handles a blocked website

Permission Groups

Access Profiles

Safety Controls

How to Configure