Automated FortiGate backups with time stamps, encryption, and notifications

[albaker1]

We're using the script below to backup our FortiGates, but it creates only one backup file name. We'd like to keep the last 5 backups, which we can manage with a cron job. How do we append the time date/timestamp to the script? We'd like to ensure the backup files are encrypted, so is there a way to encrypt the files? We'd also like to be notified if the backups were successful or not, so is there a way to incorporate this? Thank you.

Step 1:
config system automation-trigger
edit "Backup"
set trigger-type scheduled
set trigger-frequency daily <----- Frequency of the action.
set trigger-hour 23 <----- Hour of the triggered action.
set trigger-minute 58 <----- Minute of the triggered action.
next
end

Step 2:
config system automation-action
edit "Backup"
set action-type cli-script
set minimum-interval 0 <----- Limit execution to no more than once in this interval (in seconds).
! set delay 0 <-----Delay before execution (in seconds).
! set required enable
set script "execute backup config sftp /ftg_backup.conf 1.1.1.1 username password
next
end

Step 3:
config system automation-stitch
edit "Backup"
set status enable
set trigger "Backup"
config actions
edit 1
set action "Backup"
next
next
end

[xshkurti · Accepted solution]

@albaker1 
If you are using FortiManager or FortiAnalyzer, please follow below link on how to schedule and encrypt your backups:
Technical Tip: How to send automatic and scheduled... - Fortinet Community

Otherwise, you can also edit backup command to encrypt them with a password:

execute backup config sftp /fgt-backup.conf 1.1.1.1 sftp-username sftp-password encryption-password

Further more, you can add date at your filename as per below

execute backup config sftp /fgt-backup%%date%%.conf 1.1.1.1 sftp-username sftp-password encryption-password

If you have found a solution, please like and accept it to make it easily accessible for others.

Regards!

@xshkurti 

[albaker1]

We do have FortiManager, but our local rep has recommended we not use the 7.4 versions yet. 

I configured the script with the encryption-password, and the backup file is about 25% the size of non-encryted - do you know if the encryption process zips the config first? Since this is a test system, I did a restore, and it came back functioning OK, but the decrease in size concerns me.

I've also tried both %%date%% and %%log.date%% in the script, and the file name has this string and not the date: fortigate_backup_%%log.date%%.conf. Do you know if the behavior is any different running directly from the CLI vs. letting the backup process automatically initiate?

[albaker1]

We've actually tested backups with encrypted and nonencrypted on 3 different FortiGates, and the nonencrypted is always substantially larger. I'll presume compression is only used when encrypting, but everything looks good at this point. 

We're still having alerting problems, but given we've got this far, I'll close this one down and open on specifically for alerting. Thanks, xshkurti.