> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiGate

> Connect each client's FortiGate to Triggr directly with a FortiOS REST API administrator token.

Triggr connects straight to each client's FortiGate to read its live state and configuration, manage policies, objects, interfaces, administrators, users and VPN settings, upgrade firmware, and send any FortiOS REST API request. To reach firewalls through a system that already manages them, use [FortiManager](/integrations/fortinet/fortimanager) or [FortiGate Cloud](/integrations/fortinet/fortigate-cloud).

You need FortiOS 6.4 or later, a super\_admin on the FortiGate, and a public IP address or hostname for its management interface. Triggr doesn't connect to private addresses.

## Set up the FortiGate

Repeat these steps on each client's FortiGate.

<Steps>
  <Step title="Create an administrator profile">
    In **System > Admin Profiles**, click Create New. Set each area your workflows read to Read and each area they change to Read/Write, leave the rest at None, and click OK.
  </Step>

  <Step title="Create a REST API administrator">
    In **System > Administrators**, select Create New > REST API Admin. Choose your profile in Administrator Profile, leave PKI Group off, and add each of Triggr's [outbound IP addresses](/security/ip-allowlist) under Trusted Hosts with a `/32` mask. Click OK and copy the token, which FortiOS shows only once.
  </Step>

  <Step title="Allow HTTPS management">
    In **Network > Interfaces**, edit the interface with the public address and select HTTPS under Administrative Access. Note the HTTPS admin port in System > Settings > Administration Settings (443 by default), and allow Triggr's IP addresses through anything in front of the FortiGate.
  </Step>
</Steps>

See Fortinet's [REST API administrator](https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/399023/rest-api-administrator) guide.

## Connect it in Triggr

<Steps>
  <Step title="Open the client's configuration">
    Go to **Integrations > FortiGate** and click **Configure** on the client's row in the Per-Client Configuration card, or on the Base Configuration card for your own firewall.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=11464b4946bea0b580c73330d9114a41" alt="The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button." width="2272" height="646" data-path="images/integrations-common/per-client-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the token and URL">
    Enter the REST API Token and the FortiGate Management URL, such as `https://fw.example.com:8443`, with the port if it isn't 443 and no `/api/v2` or other path. If the FortiGate uses a self-signed certificate, turn on Allow insecure TLS. Click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/fortinet-fortigate/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=7d3b1b2bdbca19e219e0b6644437c180" alt="The FortiGate configuration window with REST API Token and FortiGate Management URL fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1222" data-path="images/fortinet-fortigate/configure.png" />
    </Frame>
  </Step>
</Steps>

Per-client integrations never fall back to the Base Configuration, so every client whose workflows use FortiGate needs its own row. Run Get System Status to check one works. The Generic actions take `fortiosPath`, the path after `/api/v2/`, such as `cmdb/firewall/policy`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="No FortiGate integration is configured for this client">
    Configure the client in the Per-Client Configuration card.
  </Accordion>

  <Accordion title="Authentication errors (401)">
    Check the token is complete and hasn't been regenerated, and that every Triggr IP address is in the administrator's Trusted Hosts.
  </Accordion>

  <Accordion title="Permission errors (403)">
    Set the area the action uses to Read or Read/Write in the administrator profile.
  </Accordion>

  <Accordion title="Connection fails or times out">
    Check the URL is the public address with `https://` and the right port, the interface allows HTTPS, nothing in front blocks [Triggr's IP addresses](/security/ip-allowlist), and the hostname doesn't resolve to a private address. For certificate errors, turn on Allow insecure TLS.
  </Accordion>

  <Accordion title="404 errors">
    Check FortiGate Management URL has no path after the host and port, and that the object or policy exists in the VDOM the step uses.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.