copying config via TFTP is failing

[Tandra]

Is there any way I can send the local traffic towards the VPN interface ?

I am trying to copy the firewall config from the firewall to my TFTP server that is sitting behind another firewall.

I have a VPN between the two firewall, ie the firewalls are the tunnel endpoints

And this traffic is not the traffic from the network that is firing up the tunnel.

So am I right in thinking that I cannot get it via tftp over a IPsec VPN tunnel via the setup that I have mentioned.

So if there is no separate WAN provision I have to have local tftp server for storing the firewall config  right ?

[Toshi_Esumi]

I haven't done but based on the thread below thread it seems to be possible to send it over VPN.

https://forum.fortinet.com/tm.aspx?m=121112

Only unknown part is the source IP it would pick. So you need to sniff it to figure out the source IP of the packets, then adjust your IPSec to allow it both ways, then set up proper routes on both sides.

Or somebody else who knows this might jump in to tell yea or nay.

[ede_pfau · Accepted solution]

Depending on what your goal is: use TFTP or to get the config backed up, there are different solutions.

AFAIK you cannot set the source IP for local TFTP traffic. So, if the FGT chooses to use the WAN IP as the originating IP this will be difficult to route. You could try to use a host route (/32) with the WAN IP to point to the tunnel.

A better solution would be to use SCP to pull the config. I'm using this regularily with a (big) number of managed FGTs, across IPsec VPNs, embedded in a Python script. There are a couple of posts about SCP and how to enable it for admin use on the forums.

[sw2090]

well you have to tell the firewall two things: 1. the ip of your tftp-server and 2. a way to get there. So if they are not on the same net you either have to have static routing for the other net plus policy allowing this traffic or you have to have a policy allowing this traffic doing NAT. NAT has the advantage that you can "stick" it to a specific source ip by doing snat and using the ip of the source device. However I'm not sure if tftp will work with NAT. The Firewall on the "other side" of your tunnel will have to allow the traffic too then.

Using scp will still have that traffic issue however it's vice versa then because you have to initiate scp transfer from the opposite side. Maybe though that's easier to handle.

You just have to enable it on your FGT via Cli or (if you have) Cli Options in FMG gui.