Automated Full-config backups

[ilucas]

We would like to be able to scheduled automated full-config backups to be offloaded to an FTP server. I know the fortimanager has backup capabilities of configs for its registered devices but we do not really need a full central management system (though it would be nice).

I'm wondering if anyone has used other solutions/workarounds to make this happen. I believe FortiMail or FortiWeb devices have a scheduled backup that can be run, but not FortiGate.

Thank you,

Ian

[Dave_Hall · Accepted solution]

See emnoc's post about scp or search link at the top of this page.

[TechnoR05 · Accepted solution]

Hello,

We use putty run from the tftp server.

It's not the best security, also it is TFTP and all plain-text, but we have a task scheduled that does a backup every day of each vdom and also a full backup.

It's something like this :

the task runs a .bat file calling putty and login info :

C:\Putty.exe -ssh <Fortigate IP> -l <UserLoginName> -pw <UserPassword> -m C:\BackupGlobal.txt

And the txt files are similar to :

config global exe backup config tftp <Filename> <ServerIP> end exit

- -

Does what we need, you could probably build from there.

Regards

[ede_pfau]

I think the way TFTP is implemented in FortiOS it's limited. Have you considered SCP for automated backups?

[marc10k]

SCP is off course on option. Unfortunately changing this involves more than just a modification on the tftp server to accept scp. The Fortinet and its predecessor are installed in a lot of similar installations of an industrial application and changes involve also its documentation and more...

[JohnAgora]

Any ideas on how to debug the backup (ftp) process? I'm having problems

[marc10k]

Hello John

Depending on who starts the FTP session I would start looking at blocked FTP ports or the FTP session helperin the router? Is it in place and if you use another port for FTP you might have to implement a new one. Wireshark might help to see what is going on during the negotiation. Also the build in diagnose tools in the CLI are of good help. 

From my experience the most problems with FTP occur due to a blocked or not opening port. 

[JohnAgora]

You were right. It was related to ports.

Anyhow I couldn't make an efficient diagnostic on the Fortigate.

I used a FortiManager and debug there (execute backup ...; diagnose debug application curl -1), then I run the backups on the Fortigate.

Thanks!

[JohnAgora]

It is weird, last week it worked anyhow now I can't make it work.

Any idea on how to debug the backup process on a Fortigate.

On the FortiManager it works fine.

The message I get is:

Please wait...

Connect to ftp server t.backups.domain.com ...

Send config file to ftp server via vdom root failed.

Command fail. Return code 5

 Any idea? Thanks!

[brunorgl96]

how did you make rconfig work in fortigate? I can't find anything that helps on internet.

[brunorgl96]

How did you configured it?

[Aigarz]

adikad wrote:

with new FortiOS5.4 you can now have a scheduled auto config backup !

<ommitted>

Is it possible to run script only upon configuration changes or revision saves.

This would make more sense if there are units with occasional changes.

[sanderl]

adikad wrote:

with new FortiOS5.4 you can now have a scheduled auto config backup !

config system auto-script

edit "backup" set interval (secs) set repeat () set start auto set script "execute backup config tftp config.txt x.x.x.x" next end 

cheers

ã

Any hint or tip to make the filename in the above (set script "execute backup config tftp config.txt x.x.x.x") variably? Now all works fine but the file config.txt is overwritten everytime. Would like to add date and time to the filename and keep all files.