> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Kemp LoadMaster to Neo

> Turn on a client's LoadMaster API, make an API key for Neo and save it in Neo

You connect Kemp LoadMaster once for each client that uses one, with two values: the address of its API and an API key.

## Before you start

* The LoadMaster runs firmware 7.2.50 or later, which has the JSON API Neo uses.
* Neo reaches the LoadMaster over the internet. Its API must answer at a public address over **HTTPS** with a certificate from a public certificate authority. A LoadMaster's own certificate is self-signed, so Neo refuses it: give the LoadMaster's web interface a public certificate (**Certificates & Security** > **SSL Certificates** > **Administrative Certificates**), or put a reverse proxy with one in front of the API.
* Add the client to your **Companies** tab first.

### If the LoadMaster is only on the client's internal network

Most are. Publish only the API, never the web interface, through a reverse proxy at the client's network edge that:

* answers on a public name over HTTPS, with a certificate from a public certificate authority;
* forwards only the path `/accessv2` to the LoadMaster, and refuses every other path;
* accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md).

Set an **API port** on the LoadMaster (the `apiport` setting) to keep the API apart from the web interface. Save the proxy's public address in Neo.

## 1. Turn on the API

**1. Enable the API interface**

In the LoadMaster web interface, open **Certificates & Security** > **Remote Access** and check **Enable API Interface**. It is off by default.

**2. Check the web access settings**

Open **Certificates & Security** > **Admin WUI Access**. Check **Enable Session Management**, and clear **Require Basic Authentication**. The JSON API needs both.

## 2. Make a user and an API key for Neo

**1. Add a user**

Open **System Configuration** > **System Administration** > **User Management** and add a local user for Neo, such as `neo`. A user with no permissions can read everything.

**2. Give it the permissions your agents need**

Click **Modify** on the user. For the maintenance job, check **Real Servers** (enable and disable real servers). Add **Virtual Services** for an agent that enables or disables a virtual service, and more only when an agent should change the configuration.

**3. Generate the key**

In the same screen, under **API Keys**, click **Generate New APIKey** and copy the key.

Neo can do only what this user may do, whatever the agent's access profile says.

## 3. Add the connection in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **Kemp LoadMaster**](https://dashboard.neoagent.io/integrations?open=kemp_loadmaster), under Networking.

**2. Pick the client**

In **Customer**, choose the client this LoadMaster belongs to. For a second client, click **Add customer**.

**3. Save the connection**

Enter the **LoadMaster URL** (the address that serves the API, with its port when it is not 443, such as `https://lm.example.com:8443`) and the **API Key**. Click **Save settings**. Neo reads the LoadMaster's firmware version with the key before it saves, so a wrong value is rejected straight away, with what to fix.

## 4. Turn Kemp LoadMaster on per agent

**1. Open the agent's tools**

Open the agent in the Neo Dashboard, go to its **Tools & Settings** tab and click **Networking**.

**2. Pick a preset**

Expand the **Kemp LoadMaster** block and pick one of its **Presets**, or set each permission group by hand.

| Preset | What it does |
| - | - |
| **Read Only** | Reads virtual services, real servers, statistics, health, the licence and the configuration; changes nothing |
| **Helpdesk** | Reads the same; enabling or disabling a real server or a virtual service, unlocking an SSO user and ending an SSO session ask a technician |
| **IT Admin** | Enables, disables and changes virtual services, real servers, rules, limits, certificates, GEO and HA on its own; WAF, Edge Security, network, users and system settings ask a technician |
| **Full Automation** | Every LoadMaster change Neo sends, without approval except the changes that always ask |

To let an agent drain a server for maintenance on its own, set **Enable and Disable Services** to Read/Write without approval. That group holds only enabling and disabling, never a configuration change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.