Stackvora.tech

Backup and Restore a FortiGate Configuration

FortiGate firewalls are critical components in network infrastructure, often acting as the first line of defense and central routing/security policy…

FortiGate firewalls are critical components in network infrastructure, often acting as the first line of defense and central routing/security policy enforcement points. Ensuring the ability to quickly restore a device to a known working state after a hardware failure, misconfiguration, or during a migration is paramount. This article details the various methods for backing up and restoring FortiGate configurations, emphasizing best practices for different operational scenarios.

A FortiGate configuration encompasses all settings from network interfaces, routing tables, firewall policies, VPNs, user accounts, and security profiles. These configurations can range from a few kilobytes on a small FortiGate 40F to several megabytes on larger FortiGate 3000-series appliances with complex setups. The configuration file is typically a plain text file, often compressed when downloaded via GUI.

Manual Configuration Backup

Manual backups are suitable for ad-hoc saves before making significant changes or for small deployments without dedicated configuration management tools.

GUI-based Backup

The FortiGate web-based manager provides a straightforward method for downloading the configuration directly to your local workstation.

  • Navigate to System > Configuration > Backup.
  • In the Backup section, ensure the Backup location is set to Local PC.
  • For enhanced security, especially if the configuration contains sensitive data like PSKs (though these are often obfuscated), tick Encryption and provide a strong password. This encrypts the downloaded file. Remember this password, as it's required for GUI-based restoration of an encrypted backup.
  • Click Backup. Your browser will download a file named something like FG100F_config_20230315_1030.conf or backup.conf. The exact naming convention varies slightly between FortiOS versions (e.g., FortiOS 6.4.x vs 7.0.x vs 7.2.x).

Note: GUI backups are generally recommended for full configuration backups as they handle all internal references and dependencies correctly. They also typically include system-generated certificates and private keys which CLI backups might omit unless specifically exported.

CLI-based Backup

The command-line interface offers more flexibility, particularly for scripting or integrating with automation tools. CLI backups can target various protocols.

  • TFTP (Trivial File Transfer Protocol): Simple and widely supported. Requires a TFTP server running on the destination host.
execute backup config tftp fgt-backup.conf 10.0.0.5

This command instructs the FortiGate to connect to the TFTP server at 10.0.0.5 and upload its running configuration, saving it as fgt-backup.conf on the TFTP server's root directory.

  • FTP (File Transfer Protocol): More robust than TFTP, supporting authentication.
execute backup config ftp fgt-backup.conf 10.0.0.6 admin MyPa$w0rd

Here, 10.0.0.6 is the FTP server IP, admin is the username, and MyPa$w0rd is the password. The file will be named fgt-backup.conf.

  • SCP (Secure Copy Protocol): Recommended for secure, encrypted transfers. Requires an SCP server (often part of an SSH server) on the destination.
execute backup config scp fgt-backup.conf 10.0.0.7 admin MyPa$w0rd 22 /backups/

This command uses SCP to transfer the configuration to 10.0.0.7, user admin, password MyPa$w0rd, over port 22 (SSH default), saving it in the /backups/ directory as fgt-backup.conf.

Important: CLI backups (execute backup config ...) primarily back up the running configuration. They generally do not include firmware images, VDOM configurations (unless executed from within a specific VDOM), or certain system certificates/keys that are handled by the GUI backup's comprehensive approach. For these, consider backing up from the global VDOM (if applicable) and exporting individual items separately (e.g., execute certificate backup local <name> <password> tftp <server> <file>).

Automated Configuration Backup

For production environments, automated backups are essential to ensure regular snapshots of the configuration are captured without manual intervention.

FortiManager

FortiManager is Fortinet's centralized management platform and the most robust solution for automated FortiGate configuration backup and management. It pulls configurations from managed devices on a scheduled basis (e.g., daily, weekly, or upon policy changes).

  • FortiManager stores configuration revisions, allowing for easy rollback to previous versions.
  • It can push configurations to multiple devices, simplifying disaster recovery.
  • Configuration changes made directly on the FortiGate (out-of-band) can be detected and imported into FortiManager as a new revision.

Configuration of FortiManager for backups involves adding devices, assigning them to ADOMs (Administrative Domains), and then setting up "Device Settings" > "Retrieve Configuration" schedules or enabling "Auto Update" in the Device Manager. Detailed FortiManager setup is beyond the scope of this article but is the recommended enterprise solution.

Scripting via SSH

For environments without FortiManager, external scripts (Python, Bash, PowerShell) can leverage SSH to connect to the FortiGate and execute CLI backup commands.

#!/bin/bash
HOST="192.168.1.99"
USER="admin"
PASS="YourSecurePassword" # WARNING: Storing passwords in scripts is a security risk. Use SSH keys.
BACKUP_DIR="/var/ftg_backups"
TIMESTAMP=$(date +%Y%m%d%H%M)
BACKUP_FILE="${BACKUP_DIR}/${HOST}_config_${TIMESTAMP}.conf"
TFTP_SERVER_IP="10.0.0.5" # IP of the server running this script, also running TFTP

# Ensure TFTP server is running and TFTP root points to BACKUP_DIR
# e.g., for atftpd: sudo service atftpd start; configure /etc/default/atftpd to point to /var/ftg_backups

# SSH to FortiGate and execute backup command
sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no "$USER@$HOST" "execute backup config tftp ${HOST}_config_${TIMESTAMP}.conf ${TFTP_SERVER_IP}"

# Optional: verify backup file exists
if [ -f "$BACKUP_FILE" ]; then
    echo "Backup successful: $BACKUP_FILE"
else
    echo "Backup failed for $HOST"
    exit 1
fi

# Clean up old backups (e.g., keep last 30 days)
find "$BACKUP_DIR" -name "*.conf" -mtime +30 -delete

This script uses sshpass for password-based authentication (less secure, prefer SSH keys) and assumes a TFTP server is running on the host executing the script. Configure this script to run as a cron job on a Linux server or a scheduled task on Windows.

Configuration Restoration

Restoring a configuration typically involves uploading a saved file to the FortiGate. The method depends on the backup source and the current state of the device.

GUI-based Restoration

For a functioning FortiGate or one that's been factory reset but is accessible via its management interface:

  • Navigate to System > Configuration > Restore.
  • In the Restore section, choose Upload.
  • Click Upload next to Configuration File and select your .conf backup file from your local PC.
  • If the backup was encrypted during creation, you must provide the Decryption Password.
  • Click Restore. The FortiGate will process the configuration, which may take a few minutes. It will then automatically reboot.

Note: When restoring from a GUI-backed-up file, the FortiGate will attempt to apply the entire configuration, including certificates, interfaces, and VDOMs. If the target FortiGate is a different model or has a different number of interfaces, some configuration sections may fail to apply or revert to default. For example, a config from a FortiGate 100F applied to a 60F may fail due to port differences (e.g., 100F has FortiLink ports 9-16 which the 60F lacks).

CLI-based Restoration

CLI restoration is useful for devices where GUI access is unavailable (e.g., misconfigured management interface) or for scripted recovery.

  • TFTP:
execute restore config tftp fgt-backup.conf 10.0.0.5

The FortiGate will connect to the TFTP server at 10.0.0.5, download fgt-backup.conf, and apply it. The device will reboot after applying the configuration.

  • FTP:
execute restore config ftp fgt-backup.conf 10.0.0.6 admin MyPa$w0rd
  • SCP:
execute restore config scp fgt-backup.conf 10.0.0.7 admin MyPa$w0rd 22 /backups/

Pre-FortiOS 7.0 Note: Some older FortiOS versions (e.g., 6.0, 6.2) might not have SCP for configuration restore directly, or syntax may vary. Always check the Fortinet documentation for your specific FortiOS version.

Firmware Compatibility: A common issue is restoring a configuration from a device running FortiOS X.Y.Z to a device running FortiOS A.B.C. While minor patch version differences are usually fine (e.g., 7.0.8 config on a 7.0.10 device), major version differences (e.g., 6.4 config on a 7.0 device) often cause issues. It's best practice to ensure the target FortiGate is running the same (or very close) FortiOS version as the source of the backup. If a major upgrade is required, perform it on the target device first, then restore the configuration. The FortiGate will often convert the configuration during restoration but errors can occur.

Configuration Archive and Revisions (FortiGate Internal)

FortiGates maintain a limited internal history of configuration changes. While not a full backup solution, it can be useful for quick rollbacks.

  • To view saved configurations: get system config-revision list
  • To revert to a previous revision: execute restore config revision <revision_id>

The number of revisions stored is limited and varies by model and FortiOS version (e.g., typically 10 to 20 revisions). This is useful for undoing a recent misconfiguration but not for long-term disaster recovery.

Common Pitfalls and Troubleshooting

  • "A backup you've never restored isn't a backup." Always test your restore process, ideally on a spare, identical unit, or during a maintenance window. Verify all critical functionalities post-restore (routing, VPNs, policies, access to resources).
  • IP Address Conflicts: If restoring a configuration to a device connected to the same network as the original, ensure the original is disconnected first to avoid IP address conflicts after the restore and reboot. If the original IP is static, ensure your management PC is on the same subnet as the default FortiGate management IP (192.168.1.99/24) for initial access after a factory reset and restore.
  • Firmware Mismatch: As discussed, restoring a configuration from a significantly different FortiOS version can lead to unpredictable behavior or failed services. Upgrade the target FortiGate to match the backup's FortiOS version first.
  • Encryption Password Loss: If you encrypt your GUI backup, safeguard the password. Without it, the configuration file is unrecoverable via GUI restore.
  • Incomplete CLI Backups: Remember that execute backup config often omits some system-level details (e.g., certificates, VDOM settings if not executed from global). For a complete backup, GUI is often safer or requires careful manual export of individual components via CLI.
  • TFTP/FTP Server Issues: Ensure your TFTP/FTP server is running, the firewall rules on both the FortiGate and the server allow the traffic (UDP 69 for TFTP, TCP 20/21 for FTP), and the file path is correct. For TFTP, ensure the filename specified by the FortiGate is allowed by the TFTP server's root directory permissions.
  • SCP/SSH Key/Password Issues: For SCP, verify SSH connectivity, correct username/password, and that the target directory exists and has write permissions for the specified user. SSH keys are preferred over passwords for automation.
  • Hardware Differences: Restoring a configuration from one FortiGate model to a significantly different model (e.g., different port layout, different number of VDOMs supported) can result in configuration elements not being applied correctly or becoming inactive. Always aim for identical hardware models for direct configuration restores.

Back to the knowledge base · Ask the AI assistant