Author: louis.scaringella

This article does a great job of summarizing this process already, but I wanted to describe a few caveats and explain the formatting of the script a bit clearer:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-send-automated-backups-of-the-configuration/ta-p/198364

Here is an example config of this with all of the required components:

conf system automation-action
	edit AutomatedConfigBackup 
	unset script
	set script "execute backup config ftp \"/Fortinet_Backups/FortigateBackup.conf\" 10.10.10.10 \"Domain\\UserHere\" PasswordHere"
end


config system automation-trigger
	edit "AutomatedConfigBackup"
	set trigger-type scheduled
	set trigger-hour 22
	set trigger-minute 58
	next
end


 edit "AutomatedConfigBackup_FTP"
        set trigger "AutomatedConfigBackup"
        config actions
            edit 1
                set action "AutomatedConfigBackup"
                set required enable
            next
end

All of this is easy enough to follow along, except for the format of the backup script and command itself. Let’s analyze this further to see why it is formatted as such:

set script "execute backup config ftp \"/Fortinet_Backups/FortigateBackup.conf\" 10.10.10.10 \"Domain\\UserHere\" PasswordHere"

With FortiOS and this “set script” command with quotes around it, you have to use the \ character to include the “” around the path and username so it includes it exactly.

You must have quotes around the path for it to work. For Windows use the / slash for the path and \ for the domain\user

From the documentation:

Special characters

The following characters cannot be used in most CLI commands: <, >, (, ), #, ‘, and “

If one of those characters, or a space, needs to be entered as part of a string, it can be entered by using a special command, enclosing the entire string in quotes, or preceding it with an escape character (backslash, ).

To Start the debug:

diagnose wireless-controller wlac sta_filter clear
diagnose wireless-controller wlac sta_filter [MAC address here in format xx:yy] 255
diagnose debug enable
diag debug console timestamp enable

To stop the debug:

diagnose wireless-controller wlac sta_filter clear

diagnose debug disable

diag debug console timestamp disable

If you are using the SSL VPN Web Portal, and you are allowing access to resources that are accessible over a site to site VPN tunnel from the FortiGate, there are several considerations to keep in mind.

With the web portal, the firewall will proxy the connection from the user to the actual resources. If the resource is on the local network and the firewall has a route to the destination, it will source traffic from one of it’s interfaces that is “closest” to the end device. This may be the local LAN/internal interface.

However, if the resource is available only across a site to site VPN tunnel, then the firewall will try and source this traffic from the “closest” IP to the site to site VPN tunnel. If there is no IP address explicitly configured on the VPN tunnel itself, then it will choose the public IP used in the VPN tunnel termination. Many times, the public IP isn’t allowed to pass traffic across the actual VPN, and so this will be rejected.

The best thing to do would be to assign an IP address to the tunnel interface itself. When this is configured, the firewall will use this IP address to proxy and source the traffic from. Additionally, you must make sure that this IP address is allowed on the VPN as far as the proxy-IDs, routes on the other end, and any security rules on both ends that control traffic access.