Automated FortiGate backups with time stamps, encryption, and notifications
We're using the script below to backup our FortiGates, but it creates only one backup file name. We'd like to keep the last 5 backups, which we can manage with a cron job. How do we append the time date/timestamp to the script? We'd like to ensure the backup files are encrypted, so is there a way to encrypt the files? We'd also like to be notified if the backups were successful or not, so is there a way to incorporate this? Thank you.
Step 1: config system automation-trigger edit "Backup" set trigger-type scheduled set trigger-frequency daily <----- Frequency of the action. set trigger-hour 23 <----- Hour of the triggered action. set trigger-minute 58 <----- Minute of the triggered action. next end
Step 2: config system automation-action edit "Backup" set action-type cli-script set minimum-interval 0 <----- Limit execution to no more than once in this interval (in seconds). ! set delay 0 <-----Delay before execution (in seconds). ! set required enable set script "execute backup config sftp /ftg_backup.conf 22.214.171.124 username password next end
Step 3: config system automation-stitch edit "Backup" set status enable set trigger "Backup" config actions edit 1 set action "Backup" next next end
We do have FortiManager, but our local rep has recommended we not use the 7.4 versions yet.
I configured the script with the encryption-password, and the backup file is about 25% the size of non-encryted - do you know if the encryption process zips the config first? Since this is a test system, I did a restore, and it came back functioning OK, but the decrease in size concerns me.
I've also tried both %%date%% and %%log.date%% in the script, and the file name has this string and not the date: fortigate_backup_%%log.date%%.conf. Do you know if the behavior is any different running directly from the CLI vs. letting the backup process automatically initiate?
We've actually tested backups with encrypted and nonencrypted on 3 different FortiGates, and the nonencrypted is always substantially larger. I'll presume compression is only used when encrypting, but everything looks good at this point.
We're still having alerting problems, but given we've got this far, I'll close this one down and open on specifically for alerting. Thanks, xshkurti.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.