Troubleshooting Tip: Automation Stitch for FortiGate Configuration backup over SFTP/FTP does not work

[yangw]

Description	This article describes the issue when the automation action is not working, caused by a command failure. Using the built-in automation feature of FortiGate to back up the configuration file, create a CLI script command within the action to verify that the command can correctly execute the backup command to the specified path. In the process of creating Action (CLI Script) → Trigger (Schedule) → Stitch for a FortiGate, the backup file is not generated correctly.
Scope	FortiGate v7.2.
Solution	Through the debug commands below to check the details of the automation process. diagnose debug reset diagnose debug application autod -1 diagnose debug console timestamp enable diagnose debug enable Output: 2024-08-09 09:36:11 pid:306-__handle_msg()-414: Subscriber:4 received package. pubid:0 pkgid:43502 pkg_index:189 2024-08-09 09:36:11 pid:306-__handle_pkg_logs()-356: Subscriber:4 processing package size:88582 logs:65 pickup:1 2024-08-09 09:36:11 pid:306-__subscr_close_cur_pkg()-140: close package size:88582 logs:65 2024-08-09 09:36:13 __action_cli_script_open()-186: cli script action:Fortigate-configBek-CLI is called. svc ctx:0xb906a40 accprof:super_admin script: execute backup config sftp /FortiGate/FG-400F-1-%%date%%.conf acds.gosir.com fortiBek Passw@rd 2024-08-09 09:36:13 __cli_script_close()-121: cli script: autod.6 output: ########## script name: autod.6, offset: 354########## ========= #1, 2024-08-09 09:36:13 ========== FG-400F-1 execute backup config sftp /FortiGate/FG-400F-1-2024-08-09.conf acds.gosir.com fortiBek Passw@rd 8762: Unknown action 0             <-- Command fail. Return code -1    <-- The error message above means the backup command 'execute backup config sftp /FortiGate/FG-400F-1-2024-08-09.conf acds.gosir.com fortiBek Passw@rd' cannot be recognized by FortiGate. FortiGate supports the format below to back up the configuration to the SFTP. execute backup config sftp </directory/filename> <SFTP server>[<:SFTP port>] <username> <password> In this case, FortiGate has been configured with multiple VDOMs; the command needs to be run under the Global VDOM, after adding the command 'config global' in front of the backup commands as below, then the automation action feature works. config global execute backup config sftp /FortiGate/FG-400F-1-2024-08-09.conf acds.gosir.com fortiBek Passw@rd In this case, FortiGate has been configured in an HA cluster, and the built-in MGMT port is configured as a dedicated HA port. The backup command will give the following error: Send config file to sftp server via vdom root failed. Command fail. Return code -1 To fix this type of scenario, entering hidden vsys_mgmt vdom will make it possible to execute the backup job: config vdom     edit root    execute enter vsys_hamgmt execute backup config sftp /FortiGate/FG-400F-1-2024-08-09.conf acds.gosir.com fortiBek Passw@rd Sometimes the automation stitch fails with the error "The Current user does not have the permission to backup config". This happens if the user profile selected is not the super admin. Make sure to select the super_admin profile under the Administrator Profile. Ensure that the automation script includes two carriage returns after the 'config global' command to allow proper execution.