FortiGate – network configuration management set-up

How to enable configuration management (backup/restore) on Fortigate

1. SSH should be enabled.
2. TFTP should be enabled and allowed at the firewall on both, the Fortigate and Collector host firewalls (see the warning below).
3. SSH account provided for unlocking must be super_admin or admin
4. The maximum limit for the configuration file is 5MB
5. Hash for passwords and other encrypted data may be shown as different when comparing configurations even if the password is the same
6. A firewall rule must allow TFTP traffic from the Domotz agent host to the FortiGate device. For further information please check TFTP Session Helper
7. The following configuration is needed for the correct interpretation of its configuration:
   
   config system console

set output standard

end

If your agent is running on your own hardware, make sure the agent host firewall allows Inbound connections on UDP port 69. During the configuration backup, the agent starts a TFTP server to receive the configuration file.