FortiGate – network configuration management set-up

How to enable configuration management (backup/restore) on Fortigate

1. SSH should be enabled.
2. TFTP should be enabled and allowed at the firewall on both, the Fortigate and Collector host firewalls – Inbound and Outbound (see the warning below).
3. SSH account provided for unlocking must be super_admin or admin
4. The maximum limit for the configuration file is 5MB
5. Hash for passwords and other encrypted data may be shown as different when comparing configurations even if the password is the same
6. A firewall rule must allow TFTP traffic (inbound and outbound) from/to the Domotz collector host. For further information please check TFTP Session Helper
7. The following configuration is needed for the correct interpretation of its configuration:

config system console
set output standard
end

If your collector is running on your own hardware, make sure the collector host firewall allows Inbound and Outbound connections on UDP port 69. During the configuration backup, the collector starts a TFTP server to receive the configuration file from the Fortigate.

The configuration management for Virtual Domains (VDOMs) is not supported.

Unlocking FortiGate reachable through a Site-to-Site VPN (Routed Networks)

If communication between the collector and the FortiGate is routed through a VPN, the process may fail if the return path to the collector’s network is blocked due to the VPN interface lacking an assigned IP address.

For FortiGate devices, Domotz retrieves configuration files by triggering a TFTP transfer from the FortiGate to the Domotz Collector. However, when TFTP traffic is sent over a site-to-site VPN, the firewall uses the interface’s outbound IP address as the source. Since many VPN tunnel interfaces lack an assigned IP, these packets often default to 0.0.0.0 as the source address. Because site-to-site VPNs enforce strict access rules, traffic originating from 0.0.0.0 is typically rejected.

To avoid this problem, configure the VPN tunnel interface with an IP address that fits within the permitted range of the VPN policy:

More details about it here: Configure IP address on an IPSec tunnel interface