With FortiOS 3.0 MR3 and up, properly configured accounts can use secure copy (SCP) to download the configuration file from a FortiGate unit. This will provide a means to create daily backups of all the FortiGate configuration files you're responsible for maintaining.
First, ssh to the device and enable SCP functionality:
[user@l00nix ~]$ ssh admin@192.168.1.99 Password: Fortigate-5001 # config system global Fortigate-5001 (global) # set admin-scp enable Fortigate-5001 (global) # end Fortigate-5001 # exit Connection to 192.168.1.99 closed. [user@l00nix ~]$
In order to automate the process for our Linux backup server the FortiGate will need to have the backup account's public key. After creating the "forticonfs" or whatever account on the backup server, creating a public/private keypair for the backup account (ssh-keygen -t rsa), log back into the FortiGate and issue the following commands:
[user@l00nix ~]$ ssh admin@192.168.1.99 Password: Fortigate-5001 # config system admin Fortigate-5001 (admin) # edit admin Fortigate-5001 (admin) # set ssh-public-key1 "ssh-rsa ... forticonfs@backups.domain.com" Fortigate-5001 (admin) # next Fortigate-5001 (admin) # end Fortigate-5001 # exit Connection to 192.168.1.99 closed. [user@l00nix ~]$
You'll need to replace the public key data with your own:
[root@backups001 ~]# cat /home/forticonfs/.ssh/id_rsa.pub ssh-rsa BBB...yf3w== forticonfs@backups.domain.com [root@backups001 ~]#
Now, perform a simple test to ensure everything's setup correctly:
[forticonfs@backups001 ~]$ mkdir forti-confs [forticonfs@backups001 ~]$ scp admin@192.168.1.99:sys_config ~/forti-confs/5001.conf sys_config 100% 258KB 257.5KB/s 00:00 [forticonfs@backups001 ~]$ ls -lah ./forti-confs -rw------- 1 forticonfs forticonfs 258K Aug 22 14:51 5001.conf [forticonfs@backups001 ~]$
From here, the entire process can be stream lines via a cron-job. With a bash script, one could enumerate through a list of devices with a simple for loop. Run the job every night at mid-night and you've got a completely automated method for backing up your configs. Should anything go wrong with a device for any reason (hardware failure, screwed up config setting, whatever), restore the config from the nightly backups archive and you're a damn hero.
Anyone else have any interesting FortiGate tricks or tips they'd like to share? Send me an email or post a comment.
Word Count: 369
