> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting FortiManager to Neo

> Create a REST API administrator in FortiManager and save its key in Neo

You connect FortiManager once at the MSP level, with two values: the address of your FortiManager and the API key of an administrator made for Neo.

## Before you start

* Your FortiManager runs **7.2.2 or later**, the first version with API keys. FortiManager Cloud is not supported by this connection.
* Neo reaches FortiManager over the internet. Its web interface must answer at a public address over **HTTPS** with a certificate from a public certificate authority. FortiManager's own certificate is self-signed, so Neo refuses it: give FortiManager's web interface a public certificate, or put a reverse proxy with one in front of it.
* Neo reaches each FortiGate through FortiManager, so the FortiGates need no access from the internet.

### If FortiManager is only on your internal network

Publish only the API through a reverse proxy at your network edge that:

* answers on a public name over HTTPS, with a certificate from a public certificate authority;
* forwards only the path `/jsonrpc` to FortiManager, and refuses every other path;
* passes the `Authorization` header through unchanged;
* accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md).

Save the proxy's public address in Neo.

## 1. Create an API administrator for Neo

**1. Add a REST API administrator**

In FortiManager, open **System Settings** > **Administrators**, click **Create New** > **REST API Admin**, and name it, such as `neo`.

**2. Choose what Neo may reach**

Set **JSON API Access** to **Read-Write**, or **Read** to let Neo report but not change. Pick an admin profile that allows what Neo should do. Under **Administrative Domain**, choose the ADOMs of the clients Neo works for, or all of them.

**3. Trust Neo's addresses**

Turn on **Trusted Hosts** and add each of [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md). FortiManager accepts the key only from a trusted host.

**4. Copy the API key**

FortiManager shows the API key once when you save. Copy it, and keep it somewhere safe, such as your password manager. On the CLI, `execute api-user generate-key neo` makes a new key.

## 2. Add FortiManager in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **FortiManager**](https://dashboard.neoagent.io/integrations?open=fortimanager), under Networking.

**2. Save the key**

Enter your FortiManager's address, such as `https://fmg.example.com` (add the port when it is not 443), paste the API key, and click **Save settings**. Neo reads FortiManager's status with the key before saving, so a wrong key, a missing trusted host or a certificate Neo cannot verify is rejected straight away.

## 3. Turn FortiManager on per agent

**1. Open the agent's tools**

Open the agent in the Neo Dashboard, go to its **Tools & Settings** tab and click **Networking**.

**2. Pick a preset**

Expand the **FortiManager** block and pick one of its **Presets**, or set each permission group by hand.

| Preset | What it does |
| - | - |
| **Read Only** | Reports ADOMs, FortiGates, policies, web filters, install status, and each FortiGate's own status and URL ratings; changes nothing |
| **Helpdesk** | Also acts on monitoring on its own; every other change and every install asks a technician |
| **IT Admin** | Installs, upgrades firmware, and changes VPN, network and system settings on its own; policies, security profiles, administration and FortiManager's own settings ask a technician |
| **Full Automation** | Every supported write without approval, except the ones listed under Safety Controls on the [FortiManager API](https://docs.neoagent.io/agents/tools/networking/fortimanager-api.md) page |

See [FortiManager API](https://docs.neoagent.io/agents/tools/networking/fortimanager-api.md) for every permission group.

**3. Tell the agent what to do**

Add an instruction, for example: "When a ticket says a website is blocked, ask the client's FortiGate how it rates the site, find the web filter that blocked it, and add the site to that web filter's URL filter as allowed, then install the policy package to that FortiGate." Allowing a site is in **Security Profiles and Web Filter**, and the install in **Installs, Scripts and Workspace**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.