Skip to main content
You connect FortiManager once at the MSP level, with two values: the address of your FortiManager and the API key of an administrator made for Neo.

​
Before you start

  • Your FortiManager runs 7.2.2 or later, the first version with API keys. FortiManager Cloud is not supported by this connection.
  • Neo reaches FortiManager over the internet. Its web interface must answer at a public address over HTTPS with a certificate from a public certificate authority. FortiManager’s own certificate is self-signed, so Neo refuses it: give FortiManager’s web interface a public certificate, or put a reverse proxy with one in front of it.
  • Neo reaches each FortiGate through FortiManager, so the FortiGates need no access from the internet.

​
If FortiManager is only on your internal network

Publish only the API through a reverse proxy at your network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only the path /jsonrpc to FortiManager, and refuses every other path;
  • passes the Authorization header through unchanged;
  • accepts connections only from Neo’s addresses.
Save the proxy’s public address in Neo.

​
1. Create an API administrator for Neo

1

Add a REST API administrator

In FortiManager, open System Settings > Administrators, click Create New > REST API Admin, and name it, such as neo.
2

Choose what Neo may reach

Set JSON API Access to Read-Write, or Read to let Neo report but not change. Pick an admin profile that allows what Neo should do. Under Administrative Domain, choose the ADOMs of the clients Neo works for, or all of them.
3

Trust Neo's addresses

Turn on Trusted Hosts and add each of Neo’s addresses. FortiManager accepts the key only from a trusted host.
4

Copy the API key

FortiManager shows the API key once when you save. Copy it, and keep it somewhere safe, such as your password manager. On the CLI, execute api-user generate-key neo makes a new key.

​
2. Add FortiManager in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → FortiManager, under Networking.
2

Save the key

Enter your FortiManager’s address, such as https://fmg.example.com (add the port when it is not 443), paste the API key, and click Save settings. Neo reads FortiManager’s status with the key before saving, so a wrong key, a missing trusted host or a certificate Neo cannot verify is rejected straight away.

​
3. Turn FortiManager on per agent

1

Open the agent's tools

Open the agent in the Neo Dashboard, go to its Tools & Settings tab and click Networking.
2

Pick a preset

Expand the FortiManager block and pick one of its Presets, or set each permission group by hand.See FortiManager API for every permission group.
3

Tell the agent what to do

Add an instruction, for example: “When a ticket says a website is blocked, ask the client’s FortiGate how it rates the site, find the web filter that blocked it, and add the site to that web filter’s URL filter as allowed, then install the policy package to that FortiGate.” Allowing a site is in Security Profiles and Web Filter, and the install in Installs, Scripts and Workspace.