Before you begin
- A Atlas AVD plan. The Integrations hub is not available on Community
- The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
- For a FortiGate connection: FortiOS 7.0 or later, and a REST API administrator key with a read-only profile
- For a FortiManager connection: FortiManager 7.2.2 or later, and a REST API administrator key with read-only access to Device Manager
- The FortiGate's or FortiManager's public https address with a publicly trusted certificate, with the address Atlas connects from added to the administrator's trusted hosts
- To sync into Vault: a Vault admin and at least one asset template (the Network Device template is a good fit)
What you can do
- Document every FortiGate, FortiSwitch and FortiAP as an Atlas Vault asset, with no manual data entry.
- Connect FortiManager once to cover every FortiGate it manages, without opening the FortiGates to Atlas.
- Map each FortiGate (or each VDOM of a multi-VDOM FortiGate) to the customer company it belongs to.
- Keep the documentation current: every hour Atlas adds new devices, updates changed details and archives devices the FortiGate no longer reports.
- See a FortiSwitch's ports live on its asset: link state, speed, PoE and VLANs, as the FortiGate reports them right now.
- See what changed and when: firmware, management IP, name, HA role, VDOM and location changes, each with the previous value kept.
- Ask Atlas Advisor about documented equipment, for example "Which FortiGate firmware versions do we have?"
Step 1: Choose FortiGate or FortiManager, and create an API key
- FortiGate (one FortiGate, directly): on the FortiGate, go to System → Administrators → Create New → REST API Admin. Give it a read-only administrator profile with read access to System, Network, and WiFi & Switch Controller, and add the address Atlas connects from to its trusted hosts. Copy the API key when FortiOS shows it; it is shown only once.
- FortiManager (every FortiGate it manages, recommended for MSPs): on the FortiManager, go to System Settings → Administrators → Create New → REST API Admin. Give it read-only access to Device Manager, turn on JSON API access, and add the address Atlas connects from to its trusted hosts. Atlas reads each FortiGate through FortiManager, so the FortiGates themselves need no inbound access.
- Either way, Atlas calls the address you enter directly, so it must be reachable from the internet over https with a publicly trusted certificate. The factory self-signed certificate is refused: FortiOS can request a Let's Encrypt certificate under System → Certificates. Atlas refuses private and internal addresses and never skips certificate checks.
Step 2: Connect in Atlas
Once connected, the card shows Manage, which opens Atlas Vault → Assets, and Disconnect. The key is stored encrypted and is never shown again.
- Select the tenant in the tenant picker.
- Go to Administration → Integrations and click Connect on the Fortinet FortiGate card.
- Choose the Connection type: FortiGate or FortiManager.
- Enter the FortiGate address or FortiManager address, with the port if it is not 443, for example https://fw.example.com:8443.
- Paste the API key. For a FortiGate, fill in VDOM only when the key is limited to one VDOM. For FortiManager, fill in ADOM only to limit Atlas to one administrative domain.
- Click Connect. Atlas reads the FortiGate's or FortiManager's status with the key before saving anything; if it is rejected, nothing is stored.
Step 3: Map each FortiGate to a company
Add one sync per FortiGate (or per VDOM). Each can be mapped only once in a tenant, so its equipment never ends up under two companies. The FortiGate itself and its HA partner are documented by the sync for its root VDOM, so a multi-VDOM FortiGate is not documented twice. When your customers live in separate Atlas tenants, connect Fortinet in each tenant.
- Open Atlas Vault → Assets → RMM & PSA sync and click Add sync.
- Source: Fortinet FortiGate.
- Device type: pick a FortiGate. A FortiGate connection lists its VDOMs (usually just one, shown by the FortiGate's hostname). A FortiManager connection lists every managed FortiGate, with its ADOM in front outside the root ADOM, and each VDOM separately when a FortiGate has more than one.
- Template: pick Network Device. Atlas fills in the field mappings for you: Name, Type, Manufacturer, Model, Serial Number, Management IP, Firmware Version and Location (a FortiAP's location). You can change or add any mapping.
- Company: the customer this FortiGate belongs to.
- Leave Sync automatically every hour on, click Save Changes, then click Run now to document it straight away.
What gets documented
- Identity: name, manufacturer (Fortinet), model and model code, serial number, and a FortiAP's MAC address.
- Type: Firewall, Switch or Access Point, and the product family (FortiGate, FortiSwitch or FortiAP).
- Network: management IP, the VDOM and (through FortiManager) the ADOM, the FortiGate a switch or access point is managed by, and the interface it connects through.
- Software: firmware version and build.
- Operational: status, authorization state, and the HA role (primary or secondary) of a FortiGate in a cluster.
- A FortiAP's profile and the location entered for it on the FortiGate.
Each device is matched by its Fortinet serial number, so renaming it, changing its IP or re-authorizing it updates the same asset instead of creating a new one. Connected clients such as laptops and phones, and firewall policy, are not documented.
Live switch ports
Open a FortiSwitch asset to see its front panel drawn from what the FortiGate reports right now: each port's link state and speed, PoE power, native and allowed VLANs, the FortiLink uplink and the switch on the other end of an inter-switch link. Hover or select a port for its details. Nothing is stored and nothing is changed; the panel reads the switch live each time you open it. If the API key's profile cannot read the switch configuration, the panel shows link state only.
Your own documentation is kept
Atlas only fills the fields you map. Notes, attachments, custom fields and anything else you add in Vault are yours and are never touched. If you edit a mapped field by hand, Atlas keeps your value; if the FortiGate later reports something different, the field is flagged under Drift to review so you can choose which to keep. A device the FortiGate stops reporting is archived, not deleted, and comes back automatically if it returns. Atlas archives a device only after a complete read, so an outage, a FortiGate whose FortiManager tunnel is down, or a rejected key never empties your documentation.
Change history
Open an asset's ⋯ menu and choose History to see what changed: when the device was first documented, a new name, model, management IP, firmware, HA role, managing FortiGate, connecting interface, location or VDOM (each with the previous and new value), when it was no longer reported, and when it came back. Routine online and offline changes are not recorded. The same entries appear on the Operations Timeline.
Ask Atlas Advisor
Atlas Advisor answers questions from the documented assets, read-only and limited to what you can see in Vault, with or without an AI provider. For example: "list our FortiSwitches", "Which FortiAPs are disconnected?", "Which FortiGate firmware versions do we have?" or "Is our FortiGate connected?".
What the integration does not do
- It is read-only. It never changes configuration, installs policy, authorizes a switch or access point, or upgrades firmware. Through FortiManager it only sends read requests.
- It does not document connected clients or firewall policy.
- It does not read FortiGate Cloud; connect the FortiGate or its FortiManager instead.
- It cannot reach a FortiGate or FortiManager on a private address, or one with a self-signed certificate.
- It syncs every hour or when you click Run now; the interval cannot be changed.
- It connects one FortiGate or one FortiManager per Atlas tenant. Credentials cannot be edited in place: disconnect and connect again with the new key.
GCC High tenants
On a tenant or deployment in Azure Government (GCC High), calls to Fortinet are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from Fortinet stay empty. The operator who runs your Atlas deployment can approve Fortinet as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Disconnecting
Click Disconnect on the card and confirm. Atlas deletes its stored copy of the API key and pauses every Atlas Vault sync from Fortinet. The documented assets and their history stay in Vault; turn the syncs back on after you reconnect. Nothing changes on the FortiGate or FortiManager. Delete the REST API administrator there too if you no longer need it.
Troubleshooting
- The connection test fails with 401: the key is wrong or revoked, or the address Atlas connects from is not in the REST API administrator's trusted hosts.
- The connection test fails with 403, or switches and access points are missing: the administrator profile cannot read them. Give it read access to WiFi & Switch Controller on a FortiGate, or Device Manager on FortiManager.
- fortigateUrl must be the FortiGate's or FortiManager's https:// address: enter the https address, for example https://fw.example.com:8443.
- Could not connect: the address is not reachable from the internet, or its certificate is self-signed. Use a public address with a publicly trusted certificate.
- A FortiGate is missing from the Device type list: on a FortiManager connection, check that it is managed in an ADOM the key can read (and, if you set an ADOM, that it is in that one).
- A sync through FortiManager fails for one FortiGate: FortiManager could not reach it. Check its connection status in Device Manager; the documentation is kept until it is reachable again.
- A sync reports the integration is not configured: Fortinet was disconnected. Connect it again, then turn the sync back on.