Skip to main content
Tandra
Tandra
New Member
June 29, 2018
Solved

copying config via TFTP is failing

  • June 29, 2018
  • 2 replies
  • 8163 views

Is there any way I can send the local traffic towards the VPN interface ?

 

I am trying to copy the firewall config from the firewall to my TFTP server that is sitting behind another firewall.

I have a VPN between the two firewall, ie the firewalls are the tunnel endpoints

And this traffic is not the traffic from the network that is firing up the tunnel.

So am I right in thinking that I cannot get it via tftp over a IPsec VPN tunnel via the setup that I have mentioned.

So if there is no separate WAN provision I have to have local tftp server for storing the firewall config  right ?

 

 

 

 

    Best answer by ede_pfau

    Depending on what your goal is: use TFTP or to get the config backed up, there are different solutions.

    AFAIK you cannot set the source IP for local TFTP traffic. So, if the FGT chooses to use the WAN IP as the originating IP this will be difficult to route. You could try to use a host route (/32) with the WAN IP to point to the tunnel.

     

    A better solution would be to use SCP to pull the config. I'm using this regularily with a (big) number of managed FGTs, across IPsec VPNs, embedded in a Python script. There are a couple of posts about SCP and how to enable it for admin use on the forums.

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 29, 2018

    I haven't done but based on the thread below thread it seems to be possible to send it over VPN.

    https://forum.fortinet.com/tm.aspx?m=121112

    Only unknown part is the source IP it would pick. So you need to sniff it to figure out the source IP of the packets, then adjust your IPSec to allow it both ways, then set up proper routes on both sides.

    Or somebody else who knows this might jump in to tell yea or nay.

      ede_pfau
      SuperUser
      ede_pfauAnswer
      SuperUser
      July 1, 2018

      Depending on what your goal is: use TFTP or to get the config backed up, there are different solutions.

      AFAIK you cannot set the source IP for local TFTP traffic. So, if the FGT chooses to use the WAN IP as the originating IP this will be difficult to route. You could try to use a host route (/32) with the WAN IP to point to the tunnel.

       

      A better solution would be to use SCP to pull the config. I'm using this regularily with a (big) number of managed FGTs, across IPsec VPNs, embedded in a Python script. There are a couple of posts about SCP and how to enable it for admin use on the forums.

        sw2090
        SuperUser
        sw2090
        SuperUser
        July 2, 2018

        well you have to tell the firewall two things: 1. the ip of your tftp-server and 2. a way to get there. So if they are not on the same net you either have to have static routing for the other net plus policy allowing this traffic or you have to have a policy allowing this traffic doing NAT. NAT has the advantage that you can "stick" it to a specific source ip by doing snat and using the ip of the source device. However I'm not sure if tftp will work with NAT. The Firewall on the "other side" of your tunnel will have to allow the traffic too then.

         

        Using scp will still have that traffic issue however it's vice versa then because you have to initiate scp transfer from the opposite side. Maybe though that's easier to handle.

        You just have to enable it on your FGT via Cli or (if you have) Cli Options in FMG gui.

        Terms & ConditionsAccessibility statement