Technical Tip: Get backup config file on FortiGate using RestAPI via Python script

Demir21 · ‎12-31-2021

Description

This article describes another way on how to get the backup configuration file on FortiGate using HTTPS RestAPI calls from a Python script.

Scope

FortiGate.

Solution

Create a REST API Admin in FortiGate under System -> Administrators -> Create New -> REST API Admin to have access to it via API.
Save the API key that is generated immediately after selecting on 'Save' button as in the screenshot below:

Ensure that the API admin is set with super_admin rights, CLI must be used:

config system api-user
edit "test"
set api-key ENC blahblah
set accprofile "super_admin"
set vdom "root"
next
end

Create an empty file in Linux using the command: nano /home/backup.py.
Add the following Python script in the file and save it:

Import requests:

import requests

api_url = 'https://10.191.20.122/api/v2/monitor/system/config/backup?scope=global&access_token=Api_Key_Generate...'

requests.packages.urllib3.disable_warnings()

data = requests.get(api_url, verify=False)

with open('/home/api_configbackup.conf' ,'wb') as f:

for line in data:

f.write(line)

Where 10.191.20.122 is the IP of the FortiGate.

For FortiOS 7.4.5 + the authentication needs to be passed in the header, and Api_Key_Generated needs to be moved from the link inside the get request header. Script will be:

import requests

api_url = 'https://10.191.20.122/api/v2/monitor/system/config/backup?scope=global'

    requests.packages.urllib3.disable_warnings()
    headers = {"Authorization": "Bearer Api_Key_Generated"}
    data = requests.get(api_url, verify=False, headers=headers)

with open('/home/api_configbackup.conf' ,'wb') as f:

for line in data:

f.write(line)

The scope is global for the global configuration of the FortiGate.

Api_Key_Generated is the value of the token we previously generated.

/home/api_configbackup.conf is the place in the Linux machine where to save the backup file.

Execute the Python script created with the command python3 /home/backup.py

The file api_configbackup will be created in the specified directory with the configurations of the Fortigate included.

For chassis-based products (such as 6K - 7K) it may be necessary to set the scope to Global in the account profile to make this work as expected:

config system accprofile
edit "API-BACKUP"
set scope global --> Set the scope to global under the relevant accprofile.
set secfabgrp read-write
set ftviewgrp read-write
set authgrp read-write
set sysgrp read-write
set netgrp read-write
set loggrp read-write
set fwgrp read-write
set vpngrp read-write
set utmgrp read-write
set wifi read-write
next