Fortigate TFTP configuration script

How many times have you not wished for a function to grab your valuable configurationfiles automatically for safety reasons if your Fortigate should die ?

This simple script in Linuxenvironment will contact your Fortigate and tell it to send it´s configurationfile to your TFTP server. The script requires that you have the expect function installed on your server from where you´ll execute the script.

#!/usr/bin/expect -f
set timeout 60
spawn ssh admin@fgt-ipaddress
expect “password: $”
set send_slow {1 0.05}
send -s “password\r”
send_user “password\r”
send -s ” config global\n”
send -s “execute backup full-config tftp filename.txt tftp-ipaddress\n”
send -s “exit\n”
interact

Where the bold information for you to enter. The italic row is ONLY used if you´re running VDOM´s.

Use chmod 700 scriptfilename to make this scriptfile executable and then configure your crontab for whatever schedule you wish.

Fortigate SCP backup

Here is a small guide to backup Fortigate config with SCP

Using the Web-based manager:
Go to System > Admin > Settings.
Make sure SCP is enabled

Go to System > Network > Interface.
Select the Edit icon for the interface you use for administrative access.
In the Administrative Access section, select the SSH check box.
Click OK.

Create a public-private key pair using a key generator tool compatible with your SCP client.
root@linux:~# ssh-keygen -t rsa -b 2048 -f /tmp/fw-001
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): ENTER
Enter same passphrase again: ENTER
Your identification has been saved in /tmp/fw-001.
Your public key has been saved in /tmp/fw-001.pub.

Save the private key to the location on your computer where your SSH private keys are stored.
root@linux:~# mv /tmp/fw-001.pub /etc/
root@linux:~# mv /tmp/fw-001 /etc/fw-001.sec

Connect to the fortigate using SSH.
root@linux:~# ssh admin@x.x.x.x

config system admin
edit admin
set ssh-public-key1 "[paste content from /etc/fw-001.pub]"
end

And you are done! :)

To trigger the copy, run the following command from bash.
root@linux:~# scp -i /etc/fw-001.sec admin@x.x.x.x:sys_config /backup/fw-001.fg.bin

How-To create a basic configuration on a Fortinet Fortigate

is post will explain some useful command on a fortigate firewall. This post assume you have a Fortinet Fortigate device and want to use it to connect your local network (192.168.1.0/24) to internet and you have an internet connection. This post also assume that you have a router with a pubblic IP address 111.222.111.1 and you have a pubblic subnet 111.222.111.0/29. In this case I’ve used a point-to point device to detect the connection failure with IP address 111.222.111.123.
Obviously you must change your private (INTERNAL) IP address to adapt it to your network, and use your public subnet and not the one used here for the example (111.222.111.0/29).

config system global # Set the http admin port to 80/tcp set admin-port 80
# Set the https admin port to 443/tcp set admin-sport 443
# Set the ssh admin port to 22/tcp set admin-ssh-port 22
# Set the telnet admin port to 23/tcp set admin-telnet-port 23
# Set the hostname set hostname “FGT50B-MAGAZZINO”
# Set the ntp server to “time.ien.it” and enable it set ntpserver “time.ien.it” set ntpsync enable
# Set to 43200 seconds the tcp-halfclose timer set tcp-halfclose-timer 43200 end
# Set the telnet 23/tcp port timeout to 43200 seconds. # This is very useful if you have an AS400 (iSeries) to avoid session timeout. config system session-ttl set default 43200 config port edit 23 set timeout 43200 next end
# Set the IP address and administrative access options (ping https http) for INTERNAL interface. config system interface edit “internal” set ip 192.168.1.254 255.255.255.0 set allowaccess ping https http set type physical next
# Set the IP address and administrative access options (ping https) for WAN1 interface. # Set “gateway Detect” option enable and set the “Ping Server” destination.

# Set the interface speed to 10 Mb/s Half Duplex, this is useful for some connections like radio bridge. edit “wan1″ set ip 111.222.111.2 255.255.255.248 set allowaccess ping https set gwdetect enable set detectserver “111.222.111.123″ set type physical set speed 10half next end
# Set DNS Servers and DNS options config system dns set primary 192.168.1.3 set secondary 212.97.32.2 set domain ” set autosvr disable set dns-cache-limit 5000 set cache-notfound-responses disable end
# Set a firewall policy to enable traffic from INTERNAL TO WAN1 using NAT # Set a protection profile (a default one) called “scan” config firewall policy edit 1 set srcintf “internal” set dstintf “wan1″ set srcaddr “all” set dstaddr “all” set action accept set schedule “always” set service “ANY” set profile-status enable set profile “scan” set nat enable next end
# Set a default gateway on the WAN1 interface config router static edit 1 set device “wan1″ set gateway 111.222.111.2 end

FORTIGATE 60 FIREWALL CLI CONFIGURATION

Configure Interface
Fortiget-60 # config system interface
edit internal
set ip 192.168.2.1 255.255.255.0
set mode static
next
edit wan1
set ip 192.168.3.1 255.255.255.0
next
edit internal
set ip 192.168.100.1 255.255.255.0
set dhcp-server-mode none (Set DHCP Server Mode Off)
next
edit wan1
set ip 192.168.1.2 255.255.255.0
show system interface (Check interface configuration)
Configure DNS
Fortiget-60 # config system dns
set primary 165.21.83.88
set secondary 165.21.100.88
end
Configure Internal Allowaccess (ping, https)
Fortiget-60 # config system interface
edit internal
unset allowaccess
set allowaccess ping
set allowaccess https
end
Configure Wan1 Allowaccess (ping)
Fortiget-60 # config system interface
edit wan1
unset allowaccess
set allowaccess ping
end
Configure Static Route
Fortiget-60 # config router static
edit 1
set device wan1
set dst 0.0.0.0 0.0.0.0
set gateway 192.168.1.1
set distance 10
Change Admin Password
Fortiget-60 # config system admin
edit admin
set password
end
Firmware Upgrade
To upgrade the FortiGate firmware from the CLI:
1 Make sure that the TFTP server is running.
2 Copy the new firmware image file to the root directory of your TFTP server.
3 Log into the CLI as the admin administrative user.
Fortiget-60 # execute restore image