> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting FortiGate to Neo

> Create a FortiCloud API user and save it in Neo

You connect FortiGate once at the MSP level, with a FortiCloud IAM API user and the FortiGate Cloud region of your FortiGates. Neo signs in to FortiCloud with the API user for each Fortinet service it reaches.

## Before you start

* Your FortiGates are in **FortiGate Cloud**, with FortiGate Cloud management on. Changes to a FortiGate through FortiGate Cloud need a paid FortiGate Cloud subscription; reads work without one.
* You can sign in to the FortiCloud **IAM** portal as an administrator.

## 1. Create the API user in FortiCloud

**1. Add an API user**

Sign in to [FortiCloud IAM](https://support.fortinet.com/iam/#/iam-user), open **Users**, and add an **API user**. If you manage clients as accounts in a FortiCloud organization, create it at the organization level so it reaches every client account.

**2. Give it the portals Neo uses**

Under the API user's portal permissions, give it:

| Portal | Access | Neo needs it for |
| - | - | - |
| **FortiGate** (FortiGate Cloud) | **Admin**, with portal access on | Your FortiGates and their own status, logs and settings |
| **Asset Management** | Read, or read and write to let Neo register products and change their descriptions | Registrations, contracts, FortiGuard entitlements and licences |
| **Organization** and **IAM** | Read | Listing your client accounts, for the Organization Mapping tab |

A read-only permission lets Neo report but not change.

**3. Download the credentials**

Download the credentials file. It holds the **API ID** and the **password**. Keep it somewhere safe, such as your password manager.

## 2. Add the API user in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **FortiGate**](https://dashboard.neoagent.io/integrations?open=fortigate), under Networking.

**2. Save the API user**

Pick your FortiGate Cloud region, paste the API ID and the password, and click **Save settings**. Neo signs in and lists your FortiGates before saving, so a wrong password, a missing FortiGate permission or a wrong region is rejected straight away.

FortiCloud locks an API user out for up to 30 minutes after repeated failed sign-ins. When FortiCloud refuses the saved password, your agents wait ten minutes before they sign in again. Each **Save settings** signs in at once, so check the password against the credentials file before you save again.

## 3. Turn FortiGate on per agent

**1. Open the agent's tools**

Open the agent in the Neo Dashboard, go to its **Tools & Settings** tab and click **Networking**.

**2. Pick a preset**

Expand the **FortiGate** block and pick one of its **Presets**, or set each permission group by hand.

| Preset | What it does |
| - | - |
| **Read Only** | Reports devices, contracts and licences, health, firmware, logs, VPN status and policies; changes nothing |
| **Helpdesk** | Also acts on monitoring and inventory on its own; every other change asks a technician |
| **IT Admin** | Upgrades firmware, restarts devices, and changes VPN, network and system settings on its own; policies, security profiles and administration ask a technician |
| **Full Automation** | Every supported write without approval, except the ones listed under Safety Controls on the [FortiGate API](https://docs.neoagent.io/agents/tools/networking/fortigate-api.md) page |

See [FortiGate API](https://docs.neoagent.io/agents/tools/networking/fortigate-api.md) for every permission group.

**3. Tell the agent what to do**

Add an instruction, for example: "On the first of each month, list for every client the FortiGate, FortiSwitch and FortiAP contracts and FortiGuard services that expire in the next 60 days, update the warranty date on each matching configuration item, and open one renewal ticket per client." Or: "Every morning, check each client's FortiGates, switches and access points for status, firmware and configuration backup, and open a ticket in the NOC queue for each failure."


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.