# FortiGate – network configuration management set-up

## How to enable configuration management (backup/restore) on Fortigate

1. Ensure SSH is enabled, and that no login or message banners are configured (refer to the instructions below to disable banners).
2. TFTP should be enabled and allowed at the firewall on both, the Fortigate and Collector host firewalls - Inbound and Outbound (see the warning below).
3. SSH account provided for unlocking must be **super_admin** or **admin**
4. The maximum limit for the configuration file is 5MB
5. Hash for passwords and other encrypted data may be shown as different when comparing configurations even if the password is the same
6. A firewall rule must allow TFTP traffic (inbound and outbound) from/to the Domotz collector host. For further information please check [TFTP Session Helper](https://docs.fortinet.com/document/fortigate/6.0.0/Handbook/690377/trivial-file-transfer-protocol-tftp-session-helper-tftp)
7. The following configuration is needed for the correct interpretation of its configuration:

```
config system console
    set output standard
end
```

If your collector is running on your own hardware, make sure the collector host firewall allows **Inbound**and **Outbound**connections on **UDP port 69**. During the configuration backup, the collector starts a TFTP server to receive the configuration file from the Fortigate.

To disable banners on a Fortigate device, run the following commands:

```
config system global
    set pre-login-banner disable
    set post-login-banner disable
end
```

The configuration management for Virtual Domains (VDOMs) is **not**supported.

## Unlocking FortiGate reachable through a Site-to-Site VPN (Routed Networks)

If communication between the **collector** and the **FortiGate** is routed through a **VPN**, the process may fail if the return path to the **collector's network** is blocked due to the **VPN interface lacking an assigned IP address**.

For FortiGate devices, Domotz retrieves configuration files by triggering a **TFTP transfer** from the FortiGate to the Domotz Collector. However, when TFTP traffic is sent over a **site-to-site VPN**, the firewall uses the **interface’s outbound IP address** as the source. Since many **VPN tunnel interfaces lack an assigned IP**, these packets often default to **0.0.0.0** as the source address. Because site-to-site VPNs enforce **strict access rules**, traffic originating from **0.0.0.0** is typically rejected.

To avoid this problem, configure the **VPN tunnel interface** with an IP address that fits within the permitted range of the VPN policy:

Configuration settings for a tunnel interface.

1. Enter the name of the interface as "advpn1" in the Name field.
2. Leave the Alias field blank if not required.
3. Set the Type to "Tunnel Interface."
4. Select "ISP_01 (VLAN201)" in the Interface dropdown.
5. Enter "0" in the VRF ID field.
6. Choose "root" for the Virtual domain.
7. Set the Role to "Undefined" from the dropdown options.
8. Under the Address section, select "Manual" for Addressing mode.
9. Input the IP address "172.16.1.101" in the IP field.

More details about it here: [Configure IP address on an IPSec tunnel interface](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IP-address-on-an-IPSec-tunnel-interface/ta-p/193084)