Technical Tip: How to download FortiGate configuration file & debug log from GUI and CLI

Description

This article describes how to download the FortiGate configuration file from the GUI.

Scope

FortiGate.

Solution

Go to Admin -> Configuration -> Backup, select 'Local PC' in 'Backup to' and select 'OK'.
 

In the screenshot above, 'admin' is the login username of the administrator.

The configuration file will be saved with the .conf extension:

Syntax: <hostname + firmware version + build number + date+ time>.conf.

In VDOM mode, select the 'Global' option and select 'OK' to save the full configuration backup.

To back up an individual VDOM, select 'VDOM' and choose the desired VDOM from the dropdown menu. In the example below, the 'root' VDOM is selected. Select 'OK' to save the configuration backup.

Example: 

photon-kvm38_7-4_2702_202501300257.conf

Starting from v7.2.0:

• The 'Password masking' feature is available, which will replace passwords in the configuration backup file.

• Backups can be saved in either the FortiOS format or YAML format. Generally, the FortiOS format is recommended for configuration backups.

Note: If the password mask feature is enabled, all passwords (including IPsec vpn tunnel pre-shared keys) will be shown as below:

Example 1:

config system admin
    edit "admin"
        set old-password FortinetPasswordMask
        set accprofile "super_admin"
        set vdom "root"
    next
end

Example 2:

config vpn ipsec phase1-interface
    edit "vpn_1"
        set interface "wan1"
        set ike-version 2
        set peertype any
        set net-device disable
        set proposal aes256-sha256
        set dhgrp 14
        set remote-gw 1.2.3.4
        set psksecret FortinetPasswordMask
    next
end

Note: The FortiGate configuration file will display the following at the top of the file indicating that the password mask feature has been enabled:

#config-version=FGT60F-7.4.11-FW-build2878-260126:opmode=0:vdom=0:user=szhao
#conf_file_ver=12227862088869720
#buildno=2878
#global_vdom=1
#password_mask=1  

To collect the backup from the CLI:

Log in to the device from the CLI and execute the following command:

show full-configuration

Config backup from the CLI will only help in validating the configuration, as the header banner will be missing in the output.

Header banner:

config-version=FGVMK6-7.6.3-FW-build3510-250415:opmode=0:vdom=0:user=admin
conf_file_ver=250224794723206  
buildno=3510  
global_vdom=1

Related document: Support backing up configurations with password masking v7.2.1.

Debug logs, also known as FortiCare Debug report or TAC report (optional): There are two steps involved in obtaining the debug logs and the TAC report.

1. From the GUI: Go to System -> Advanced  -> Debug Logs and select 'Download Debug Logs' (up to version 6.2.2). Go to System -> Settings -> Debug Logs and select the 'Download' button (from v6.2.3 onward). 
                                                    

Go to System -> Settings -> FortiCare Debug Report and select the 'Download' button (from v7.4.0 onward).

2. From the CLI management interface via SSH or console connection:

In the command line, run the following command and let the script run until it completes. This will take a few seconds. 

execute tac report

Note: The 'super_admin' permission is required to download the debug log file and run the 'execute tac report' command. 

Related article:

Technical Tip: Download Debug Logs and 'execute tac report'