Automatic backups in FortiGate

We generate the public cable from the server that is going to execute the backup textssh-keygen -trsa -b1024 It will generate the following cl ===

mini manual to automatically make backups on the Fortigate

We generate the public cable from the server that is going to execute the backup

text

ssh-keygen -trsa -b1024

It will generate the following public key that we have to copy later

Bash

cat .ssh/id_rsa.pub
AAAAB3NzaC1yc2EAAAADAQABAAACAQC9FhYBX35Tu3lyJNovOu4n8IXrdfWpsmUanSgrS33NH7PhEU+FVAnjGp7OkZo5p1EV4UhOjwgSYoHy2NyHzpG3qXzw4P5siQlOkbrljscRR5qB8jrchEJkAEimsq9sX68tJHmAIXec7D4OVNeI8cf71h2immnGYImEUSmOM7TtvZP7mCGqI+RDE9Om07GD8sAx1Hk9Tpp2FtltHc9+hqxp4+CLUxdBmx7kvOAO9zpTBpILpKLTM4lcIOIuk+xlSfhyiRJqJPsfSvHW7ZCgxgPM3PvHj4HNzADUXaaOO13KvKU5DZuJWIHHP4eIPFCC90eAo/CWCNFwuWnDhcSII01Y1LliaggK0XZe6PcWCQ9S4xbYOpFI5O+FNajHM9uz1zB1nLoJ/Z+wGDCpn0FEf7Lk7Px9o9H2oo+LjlS1FhWL2fqWus2+LTcSImJ4EXqgbKOf4BFHZFnzHL2uhCjWzB5VO96G8CzxPoeApdARU9hpf4v2PjbTBITHdzzWwojq9u2Iwa5hzNEuL7A5FwEndrvFycXS1sAe+h04L2Q2obAOquPqTQ3akRvoW5ApqvxOXTFwqU48GgqsGCrrkNhIoFUHTHlyDyVMyr84MKa8z+ZMMRhP6Ss3h+5a4dQ8gBeZqW1tnkgzDeBDPLtl24D3ELoZm91XEq/NY2Wf5XKby3S8zQ==

We access fortigate through ssh

We configure the SCP

text

FORTIGATE # config global

FORTIGATE # config system global

FORTIGATE # set admin-scp enable

FORTIGATE # end

We configure the user

text

FORTIGATE # config global

FORTIGATE (global) # config system admin

FORTIGATE (admin) # edit backup

We add the user to the group upper_admin_readonly accprofile

text

VFORTIGATE  (backup) # set accprofile super_admin_readonly

We add hosts where we can access with this user:

text

FORTIGATE (backup) # set trusthost1 <ip/mask>

We add the RSA generated previously

text

set ssh-public-key1 «ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC9FhYBX35Tu3lyJNovOu4n8IXrdfWpsmUanSgrS33NH7PhEU+FVAnjGp7OkZo5p1EV4UhOjwgSYoHy2NyHzpG3qXzw4P5siQlOkbrljscRR5qB8jrchEJkAEimsq9sX68tJHmAIXec7D4OVNeI8cf71h2immnGYImEUSmOM7TtvZP7mCGqI+RDE9Om07GD8sAx1Hk9Tpp2FtltHc9+hqxp4+CLUxdBmx7kvOAO9zpTBpILpKLTM4lcIOIuk+xlSfhyiRJqJPsfSvHW7ZCgxgPM3PvHj4HNzADUXaaOO13KvKU5DZuJWIHHP4eIPFCC90eAo/CWCNFwuWnDhcSII01Y1LliaggK0XZe6PcWCQ9S4xbYOpFI5O+FNajHM9uz1zB1nLoJ/Z+wGDCpn0FEf7Lk7Px9o9H2oo+LjlS1FhWL2fqWus2+LTcSImJ4EXqgbKOf4BFHZFnzHL2uhCjWzB5VO96G8CzxPoeApdARU9hpf4v2PjbTBITHdzzWwojq9u2Iwa5hzNEuL7A5FwEndrvFycXS1sAe+h04L2Q2obAOquPqTQ3akRvoW5ApqvxOXTFwqU48GgqsGCrrkNhIoFUHTHlyDyVMyr84MKa8z+ZMMRhP6Ss3h+5a4dQ8gBeZqW1tnkgzDeBDPLtl24D3ELoZm91XEq/NY2Wf5XKby3S8zQ==»

Definimos el VDOM de management

text

FORTIGATE  (backup) # set vdom root

We save

FORTIGATE (backup) # end

Now you just need to add a script to perform the backup in the server's crontab.

Bash

#!/bin/bash
#Definimos las variables
DATE=`date +%Y%m%d`

USER=»backup» #Usuario que se va a conectar mediante ssh

NUM=»2″ #Definimos el numero de backups que va a realizar, en este caso en dos fortis

FORTINAME[1]=»fortigate1″ #hostFORTINAME del forti1

FORTINAME[2]=»fortigate2″ #hostFORTINAME del forti12

LOCALPATH=»/backup/» #file system local donde se van a guardar los backups

LOG=»/var/log/backupfortigate.log» #Log

REMOTEPATH[1]=»DIRECCION_IP_FORTIGATE1:sys_config» #Direccion forti1:fichereo a realizar el backup, en este caso la configuración

REMOTEPATH[2]=»DIRECCION_IP_FORTIGATE2:sys_config» #Direccion forti2:fichero a realizar el backup, en este caso la configuración
TEMPORAL=»mail» #Archivo temporal donde se va a guardar toda la informacion para enviar el correo

#Datos de a quienes va a mandar el correo.

SUBJECT=»0″

SENDTO=»backup@red-orbita.com,comunicaciones@red-orbita.com»

SENDCC=»rokitoh@red-orbita.com»
#Comprueba si el file system /backup está montado, y si no lo esta lo monta.

if [ `df | grep backup | wc -l` -eq 0 ] ; then

mount -t ext4 /backup

fi
echo -e «Buenas noches.\n\n\tResumen de backup:\n» > $TEMPORAL
#Empieza a pasar los ficheros mediante scp
for((i=1;i<=$NUMFTG;i++)) ; do

scp $USER@${REMOTEPATH[$i]} $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf

done
#Le cambia los permisos.
for((i=1;i<=$NUMFTG;i++)) ; do

if [ -f $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf ] ; then

chmod 640 $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf

chown ‘root:root’ $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf

echo -e «\tOK – $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf» >> $TEMPORAL

else

echo -e «\tKO – $LOCALPATH${FORTINAME[$i]}/fgt_system.${FORTINAME[$i]}.$DATE.conf» >> $TEMPORAL

SUBJECT=»1″

fi

done
#Manda el correo
if [ $SUBJECT -eq 0 ] ; then

echo -e «\n\nSaludos.» >> $TEMPORAL

cat $TEMPORAL | mail -s «Informe Backup FortiGate $DATE – OK» -c $SENDCC $SENDTO

else

echo -e «\n\tRevisar el log: $LOG \n\nSaludos.» >> $TEMPORAL

cat $TEMPORAL | mail -s «Informe Backup FortiGate $DATE – KO (Revisar)» -c $SENDCC $SENDTO

fi

#Elimina los ficheros temporales generados.
rm -rf $TEMPORAL
find $LOCALPATH -iFORTINAME «*.conf» -mtime +30 -exec rm -rf {} \;

All the best,

Comments