Skip to content

Add a FortiGate to the Network Monitor

The Network Monitor (monitor.myunifiedbx.com/devices/) polls each FortiGate over the FortiOS REST API and shows model, firmware, WAN IP, uptime, VPN tunnel state, and reachability. To add a unit you create a read-only REST API admin on the FortiGate, lock it to the monitor's IP, and register the token in the dashboard. Nothing on the FortiGate changes beyond that one read-only account.

Monitor source IP

Every poll comes from the Network Monitor host 207.246.123.103. That IP must be able to reach the FortiGate's HTTPS admin port, and it's the only trusted host you set on the API account.

Before you start

  • Admin access to the FortiGate GUI.
  • The FortiGate's WAN IP or FQDN and its HTTPS admin port (default 443).
  • HTTPS administrative access allowed on the interface the monitor reaches (see Manage Admin Accounts for trusted-host concepts).

Steps

1. Create a read-only REST API admin

  1. System → Administrators → + Create New → REST API Admin.
  2. Fill in:
    • Username — netmon.
    • Administrator Profile — a read-only profile. super_admin_readonly works, or build a custom profile with Read on System, Network, and VPN (see Create Admin Profiles).
    • PKI Group — Disable.
    • CORS Allow Origin — leave default.
    • Trusted Hosts — 207.246.123.103/32. Required — this restricts the token to the monitor only.
  3. OK. The API token is shown once — copy it now.

Token is shown only once

Copy the token before closing the dialog. If you lose it, edit the account and regenerate — it can't be retrieved later.

2. Confirm the monitor can reach HTTPS admin

The monitor connects to https://<wan-ip>:<port>/api/v2/.... Make sure:

  • HTTPS admin access is enabled on the interface the monitor reaches: Network → Interfaces → the WAN/mgmt interface → Administrative Access → HTTPS.
  • Any upstream ACL or the FortiGate local-in policy permits 207.246.123.103 to that HTTPS port.

3. Register it in the Network Monitor

  1. Open https://monitor.myunifiedbx.com/devices/ and click + Add Device.
  2. Type → FortiGate (REST API).
  3. Fill in:
    • ID — lowercase/digits/hyphens, e.g. fg-sitename.
    • Client / Location — where it belongs (e.g. Acme Co / Main Office).
    • Label — friendly name.
    • Host — WAN IP or FQDN.
    • Port — 443 (or your custom HTTPS admin port).
    • API Token — paste the token from step 1.
  4. Add Device.

Verify

  • The new card shows the model, FortiOS version, WAN IP, and VPN tunnel count within a poll cycle (~30s).
  • Open the card → Run Diagnostic → API should read 200 OK.

Common issues

  • API 401 / permission denied — token wrong, or the account's Trusted Host doesn't include 207.246.123.103/32.
  • Timeout / offline — HTTPS admin not allowed from the monitor IP, wrong port, or the WAN IP changed.
  • 403 on some data — the API profile is too restrictive; give it Read on System, Network, and VPN.
  • VPN shows down — that reflects real tunnel state, not a monitor fault.