Skip to main content

​
Before you start

  • Neo uses FortiMail’s REST API, which Fortinet documents for FortiMail 7.0 and later. It is off until you turn it on (step 1).
  • Neo reaches FortiMail over the internet. Its admin interface must answer on HTTPS with a certificate from a public certificate authority, at a public address, and accept connections from Neo’s addresses.

​
Publish only the API

Never publish the whole admin interface to the internet. Either:
  • limit Neo’s administrator to Neo’s addresses with Trusted hosts (step 2), and allow HTTPS administrative access only on the interface and addresses you need; or
  • put a reverse proxy at your network edge that answers on a public name over HTTPS with a public certificate, forwards only paths under /api/v1/ to FortiMail, refuses every other path, accepts connections only from Neo’s addresses, and passes cookies through in both directions.
Save the public address in Neo.

​
1. Turn on the REST API

In the FortiMail CLI, run:

​
2. Make an administrator for Neo

1

Pick an access profile

Open System → Administrator → Admin Profile and pick or make a profile with the access your agents need: Read on every area for an agent that only reads, and Read-Write on the areas Neo should change, such as policies, profiles, safelists and the quarantine.
2

Create the administrator

Open System → Administrator → Administrator, create an administrator for Neo with a strong password, the Local authentication type and that profile. Set Trusted hosts to Neo’s addresses. To limit Neo to some clients, set its domain to one protected domain instead of System.
Neo can do only what this administrator may do, whatever the agent’s access profile says.
FortiMail locks an administrator after too many wrong passwords. If the password expires or the account is locked, Neo loses access until you save the new password here.

​
3. Add the administrator in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → FortiMail, under Security.
2

Save the address, administrator name and password

Enter the address of your FortiMail admin interface (for example https://fortimail.example.com), Neo’s administrator name and its password, then click Save settings. Neo signs in before saving, so a wrong address, a REST API that is off or a refused password is rejected straight away.
3

Check the client links

Open the Organization Mapping tab and confirm or correct the client each protected domain belongs to.

​
4. Turn FortiMail on per agent

Open the agent, go to the Integrations section, and configure the FortiMail block.

​
Pick an access profile

Read Only

Read configuration, policies, profiles, lists, the quarantine and logs. Nothing is changed.

Helpdesk

Every change in Quarantine (releasing mail, quarantine settings) and in Safelists, Blocklists and Groups (lists, address groups, reputation and exempt lists) waits on a technician. Everything else is read only.

IT Admin

The quarantine, domains, profiles, settings and restarts change without approval, except the changes that always ask. Safelists, blocklists, policies and access rules wait on a technician.

Full Automation

Every change runs without approval, except the changes that always ask a technician.

​
Or set each area by hand

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

​
Changes that always ask a technician

These wait on a technician under every profile, whatever the area’s own approval setting:
  • Any change to administrators, admin profiles, PKI users or authentication profiles.
  • Deleting a protected domain.
  • Any change that stores a credential, such as a password or a shared secret.

​
Troubleshooting