Overview

Fortinet’s FortiManager manages the FortiGates at your clients’ sites: their policy packages, objects, web filters and settings, and the installs that push them to each FortiGate. Connect FortiManager to Neo once, at the MSP level, with one API key. The key reaches every ADOM its administrator may access, so one connection covers all your clients.

​

What Neo can do with FortiManager

• List each client’s FortiGates with their model, firmware, connection and sync status
• Ask a client’s own FortiGate how it rates a website, and read its status, sessions, VPN tunnels and logs, through FortiManager
• Find why a site was blocked: the policy, the web filter profile and its URL filter
• Allow or block a website in the client’s web filter, and install the change to the FortiGate
• Read and change policy packages, firewall policies, addresses and other objects, and install them
• Report which FortiGates are out of sync, and why an install failed

Neo changes a FortiGate’s configuration in FortiManager and installs it, the way your technicians do. It never changes it on the FortiGate directly, because FortiManager’s next install would overwrite that change. Secrets, FortiManager’s administrators, CLI scripts and templates, deleting an ADOM or a policy package, removing a FortiGate from FortiManager and a few other changes always ask a technician; every other change follows the approval setting you choose for the agent. See FortiManager API for the permission groups and access profiles. Neo reaches a self-hosted FortiManager (an appliance or a VM) over the internet. FortiManager Cloud is not supported by this connection.

​

Your ADOMs are mapped to clients

Neo matches each ADOM in your FortiManager to a client in your PSA, by the ADOM’s name and description, and keeps the mapping on the FortiManager card’s Organization Mapping tab, refreshed on each PSA metadata sync. With the mapping, an agent works in the right client’s ADOM, and on a client’s ticket it works in that ADOM only. Matching starts with the name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Last comes an AI match for the long tail. FortiManager’s own ADOMs, such as root and the ones for each Fortinet product, are not offered. A name match, or one you confirm, is handed straight to your agents. An AI match is not handed to your agents automatically. It shows on the Organization Mapping tab, where you can confirm or correct it. Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right client by hand. A mapping you set by hand survives every later sync. If you keep every client in one ADOM, there is nothing per client to map. Agents then find the client’s FortiGates by name.

​

Next steps