Skip to main content
ErrantOsi
Explorer II
April 5, 2024
Solved

Fortigate backup problems - Same command, different outputs :/

  • April 5, 2024
  • 3 replies
  • 2292 views

Hey guys, so this looks like a bug but maybe someone has an idea... :)

We have a FortiGate-1500D version 7.2.7 with VDOMs enabled. I created an automation task to do a backup via tftp. The backup executes the following CLI script:

config global
execute backup full-config tftp foldername/%%devname%%-%%date%%.conf 1.2.3.4

The task and export itself works, however I just noticed that the content of the backup is not correct. It contains only all the interfaces from the root VDOM and their whole default config, no firewalls rules from the production vdoms, no objects etc.

Now the super weird part: When I execute the CLI script manually with my hand in the CLI, it creates a correct backup full with all the necessary configurations and VDOMs etc.

The exact same backup automation stitch with the same CLI script (copy+paste) also works on other Firewall, a 100F with also 7.2.7.

 

The only visible difference for me is in the fourth line in each of the correct and incorrect backup files:

Correct backup:

#config-version=FG100F-7.2.7-FW-build1577-240131:opmode=0:vdom=1:user=daemon_admin
#conf_file_ver=65045892438396211
#buildno=1577
#global_vdom=1

 

Incorrect backup:

#config-version=FG1K5D-7.2.7-FW-build1577-240131:opmode=0:vdom=1:user=daemon_admin
#conf_file_ver=698821243992104
#buildno=1577
#global_vdom=0:vd_name=root/root

 

Does someone has an idea what the issue could be?

Best answer by ozkanaltas

Hello @ErrantOsi ,

 

Which administrator profile is selected in the Automation Action?

 

image.png

3 replies

ozkanaltas
Valued Contributor III
April 5, 2024

Hello @ErrantOsi ,

 

Which administrator profile is selected in the Automation Action?

 

image.png

ErrantOsi
ErrantOsiAuthor
Explorer II
April 5, 2024

Hey ozkanaltas!

Oh wow... that was it :D I had the default "prof_admin" inside there. After changing it to another admin profile which I created for our TACACS access the backup now contains the correct full configuration.

It looks like the "prof_admin" only can use CLI commands in specific VDOMs but not Global (with it's default config). That was it...

Thank you so much! I woud have never guessed that :D

ozkanaltas
Valued Contributor III
April 5, 2024

Hello @ErrantOsi ,

 

I'm glad it worked. :)

 

It's related to permission in the admin profile.

 

If you configure the scope area with Global, you can get config backup for all vdoms with the prof_admin profile.

 

image.png

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!