Skip to main content
birillo
birillo
New Member
November 14, 2024
Question

issue sending backup to ftp server

  • November 14, 2024
  • 5 replies
  • 3124 views

Hi,

I'm trying to schedule a full-config backup, from a 40F to a ftp server visible on vpn s2s.

 

using this command:

execute backup full-config ftp '/xxx/FGT_%%date%%.txt' 10.3.64.113 user pwd

 

I receive this output:

"Send config file to ftp server via vdom root failed."

 

ping from fgt to the server not working, so I did a packet capture for destination ip 10.3.64.113 and I found that the Fortigate use, by default, the wan interface, but in this case that port is disabled and I'm using A port as a Wan port.

 

what can i do to route the backup procedure correctly via vpn s2s using the correct tunnel-interface?

5 replies

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
November 14, 2024

Hi @birillo ,

 

How does your routing table look like?  Do you have a routing entry for 10.3.64.113 pointing to the IPSec VPN tunnel?  If the VPN is interface based, do you have IP address assigned to it?

 

So for further troubleshooting, better to provide the FGT config and routing table outputs and the name of the IPSec VPN if you have multiple VPNs.

 

 

    birillo
    birilloAuthor
    New Member
    November 15, 2024

    Hi @dingjerry_FTNT 

     

    the configuration is quite basic, I have several firewalls

    in vpn all with the same problem.

    the routing table has only the 2 classic routes, one to go out on the internet and one for traffic to the "hq" headquarters with subnet 10.0.0.0/8 via vpn tunnel.

     

    execute ping 10.3.64.113      (system uses the wan port disabled) 

    Source IP217.59.xx.xx
    Destination IP10.3.64.113

    5 packets transmitted, 0 packets received, 100% packet loss

     

    execute ping 8.8.8.8              (system uses A port that is the actual wan) 

    Source IP185.208.xx.xx
    Destination IP8.8.8.8

    64 bytes from 8.8.8.8: icmp_seq=4 ttl=118 time=7.8 ms

     

    so I tried with "execute ping-options source 10.3.84.254"  (firewall lan1 ip)

    64 bytes from 10.3.64.113: icmp_seq=0 ttl=126 time=23.4 ms

     

    and trying "execute backup full-config ftp '/xxx/FGT_%%date%%.txt' 10.3.64.113 user pwd"

    Source IP217.59.34.22
    Source Port20091
    Destination IP10.3.64.113
    Destination Port21
    ProtocolTCP

     

    do you still need the config?

    dingjerry_FTNT
    Staff
    dingjerry_FTNT
    Staff
    November 15, 2024

    Yes, I still need the config.

     

    It seems that you did not assign an IP to your IPSec VPN interface if your VPN is interface based.

    birillo
    birilloAuthor
    New Member
    November 22, 2024

    Thanks @dingjerry_FTNT 

     

    I have always set phase 2 of the tunnel with the address 0.0.0.0/0.0.0.0 and in fact the problem is exactly this.
    set the correct subnets and now the firewall knows how to reach the destination

    birillo
    birilloAuthor
    New Member
    November 27, 2024

    @dingjerry_FTNT 

    problem not solved, It worked to one tunnel only.

    I also tried to set ip to tunnel interface on both side.

     

    How can I show you the configuration in a safe mode?

     

     

    sw2090
    SuperUser
    sw2090
    SuperUser
    November 27, 2024

    I have a load of IPSEC VPNs that have phase2 with selectors on 0.0.0.0/0.0.0.0 and they work fine.

    They're all in interface mode and I never assigned an ip to the vpn interface.

    All I needed to do was to create some policy for the traffic I need to go over the vpn and also some static route for subnets behind the other side of the VPN  (and of course vice versa).

    birillo
    birilloAuthor
    New Member
    November 27, 2024

    exactly like my setup. policy and routes are ok.

    Hosts under lan interface can reach destination with no problem.

    If I use fortigate cli and I try to ping the same destination under vpn tunnel, fortigate uses its own wan interfaces (also a wan port actualy disabled)

     

    edit 4
    set name "vpn SF>TG"
    set uuid 2983524e-5319-51ea-8c87-211b2d99a8af
    set srcintf "lan"
    set dstintf "VPN-SF-HQ"
    set srcaddr "SF_NET"
    set dstaddr "NET_TG_HQ" "NET_TSS_HQ"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic all
    next


    edit 5
    set name "vpn TG>SF"
    set uuid 298f6d86-5319-51ea-e810-f4dfed618f36
    set srcintf "VPN-SF-HQ"
    set dstintf "lan"
    set srcaddr "NET_TG_HQ" "NET_TSS_HQ"
    set dstaddr "SF_NET"
    set action accept
    set schedule "always"
    set service "ALL"
    set logtraffic all

     

    S* 0.0.0.0/0 [1/0] via 81.174.0.21, ppp1
    [1/0] via 192.168.40.252, lan4
    S 10.3.0.0/16 [10/0] is directly connected, VPN-SF-HQ
    C 81.174.x.x/32 is directly connected, ppp1
    C 84.33.x.x/32 is directly connected, ppp1
    C 192.168.40.0/24 is directly connected, lan4
    C 192.168.134.0/24 is directly connected, lan

    dingjerry_FTNT
    Staff
    dingjerry_FTNT
    Staff
    November 27, 2024

    Hi @birillo ,

     

    Could you please share the info of this command?

     

    show system interface "VPN-SF-HQ"

     

    You may mask any sensitive info.

     

    Please also let me know what IP you tried to ping with the issue.

    birillo
    birilloAuthor
    New Member
    December 2, 2024

    Hi @dingjerry_FTNT thanks I resolved.

     

    - assigned IP to vpn tunnels

    - added a static route to destinations tunnel ip

    - modified policy on both firewalls to accept incoming connection from tunnel ip

     

     

    Terms & ConditionsAccessibility statement