> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiManager

> Connect FortiManager to Triggr with a REST API administrator key, or an administrator's username and password, over its JSON-RPC API.

Triggr works with FortiManager's ADOMs, managed devices, policy packages, objects and device database, reads live data from managed FortiGates through it, and can send raw JSON-RPC requests. Changes reach the FortiGates when FortiManager installs them. One configuration covers every ADOM and FortiGate, and the firewalls don't need to be reachable from Triggr.

You need a FortiManager administrator who can create administrators (such as Super\_User), and a public IP address or hostname for FortiManager with HTTPS under Administrative Access. Triggr doesn't connect to private addresses.

## Set up FortiManager

> [tab] REST API key (recommended)
>
> Needs FortiManager 7.2.2 or later.
>
> 1. In **System Settings > Administrators** (System Settings > Admin > Administrators on 7.2), select Create New > REST API Admin.
> 2. Set Admin Profile (Super\_User covers every action) and JSON API Access to Read-Write, or Read for read-only workflows.
> 3. Add Triggr's [outbound IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md) under Trusted Hosts, then click OK.
> 4. Copy the API key. FortiManager shows it only once; to replace it, click Regenerate API Key.

> [tab] Username and password
>
> For versions before 7.2.2. FortiManager needs a certificate from a trusted authority that matches its hostname.
>
> 1. In **System Settings > Administrators**, select Create New > Administrator and set a password.
> 2. Set Admin Profile and JSON API Access as for a REST API administrator.
> 3. If you use trusted hosts, include Triggr's [outbound IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md), then click OK.

Allow Triggr's IP addresses through any firewall in front of FortiManager. See Fortinet's [Creating administrators for the FortiManager API](https://docs.fortinet.com/document/fortimanager/7.4.9/administration-guide/797124).

## Connect it in Triggr

**1. Open the integration**

Go to **Integrations > FortiManager** and click **Configure** on the Base Configuration card.

![The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=bb81acb082055015f91beda7b4876f35)

**2. Enter the URL and credentials**

Enter the FortiManager URL, such as `https://fmg.example.com`, with the port if it isn't 443 and no `/jsonrpc` (include a reverse proxy's path if you use one). Enter either the REST API Key, or the Admin Username (fallback) and Admin Password (fallback); if a key is set, Triggr uses it. With a key and a self-signed certificate, turn on Allow insecure TLS. Click **Save Configuration**.

![The FortiManager configuration window with REST API Key, FortiManager URL, Admin Password (fallback) and Admin Username (fallback) fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/fortinet-fortimanager/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=571988489179ff4e1873fab8bc8c6b06)

Run Get System Status to check the connection. Actions take an `adom` (from List ADOMs, or `root` without ADOMs), `device` and `pkg`. FortiManager often reports errors with HTTP 200, so check `result[0].status` in the step's output.

## Troubleshooting

> [accordion] configure a REST API key (apiToken) or an admin username and password
>
> The configuration has no REST API Key and is missing the username or password. Enter a key, or both fallback fields.

> [accordion] login failed
>
> Check the username, password, JSON API Access and trusted hosts. If it mentions a certificate, install a trusted one or switch to a REST API key with Allow insecure TLS.

> [accordion] Authentication errors with a REST API key
>
> Check the key is complete and current, Trusted Hosts includes every Triggr IP address, and FortiManager runs 7.2.2 or later.

> [accordion] Changes are refused
>
> For "No permission for the resource" (code -11), set JSON API Access to Read-Write and check the Admin Profile and ADOM access. With workspace mode on, FortiManager only accepts Policy & Objects changes while the ADOM is locked.

> [accordion] Connection fails or times out
>
> Check the URL is the public address with `https://` and the right port, HTTPS is allowed on the interface, nothing blocks [Triggr's IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md), and the hostname doesn't resolve to a private address.

> [accordion] Monitor Device actions fail
>
> They read live from the FortiGate through FortiManager, so the device must be online and connected, with `adom` and `device` matching List ADOM Devices.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.