Troubleshooting FortiGate Configuration Backup Failures Over VPN

Purpose:

Provide guidance for diagnosing and resolving intermittent or failed configuration backups on FortiGate devices when backups are performed over VPN-connected environments in Auvik.

Symptoms

• Configuration backups fail intermittently
• Backups previously worked but have stopped
• Manual login succeeds, but backups do not complete
• Backup timestamps are outdated or inconsistent

Before You Begin

Confirm the following:

• The device is discovered in Inventory → Network Devices
• Valid credentials are configured under Discovery → Manage Credentials
• SSH access to the FortiGate is working from the Auvik collector

If these checks fail, refer to the general backup troubleshooting article.

Step 1: Verify Interface Access

On the FortiGate device:

• Ensure SSH and/or HTTPS is enabled on the interface used over VPN.
• Confirm the correct administrative services are enabled under allowaccess.
• Ensure the FortiGate management interface is reachable from the Auvik collector.

Auvik does not provide a setting to select the source interface or source IP for FortiGate configuration backups. Backup connections originate from the Auvik collector and follow the normal routing and NAT configuration between the collector and the FortiGate.

Step 2: Validate Firewall Policies

• Ensure firewall policies allow SSH/HTTPS from the Auvik collector IP or subnet.
• Verify:
  • Correct source and destination interfaces
  • Proper policy order
  • Correct VDOM context
• If Local-In Policies are used, confirm they allow the collector’s IP or subnet to access the required management services.

Step 3: Check Admin Trusthost Restrictions

If admin accounts use trusthost restrictions:

• Add the collector IP or subnet to the allowed list.
• Confirm the restriction applies to the API or CLI account used for backups.

Example location:

config system admin

Step 4: Confirm Routing, NAT, and Source IP Behavior

• Ensure return traffic is routed back to the collector through the VPN.
• Verify routing tables on both ends of the tunnel.
• Avoid asymmetric routing paths.
• If a specific source IP is required by policy, implement the appropriate routing or NAT rule in the network so the FortiGate receives the expected source address.
• Confirm that NAT is not changing the source address in a way that prevents the FortiGate’s firewall rules, Local-In Policies, or trusthost restrictions from matching.

Auvik cannot select a FortiGate source interface or source IP for the backup connection. The source is determined by the collector’s network path, routing, and NAT configuration.

Step 5: Verify Permissions and VDOM Access

• Use an account with sufficient privileges:
  • Recommended: super_admin
• Ensure access to:
  • Global configuration
  • Relevant VDOMs
  • Required SSH or HTTPS management functions

Step 6: Check VPN Stability and MTU

• Verify the VPN tunnel is stable, with no drops or resets.
• Check MTU settings.
  • Incorrect MTU can interrupt SSH or HTTPS sessions.
• Enable keepalives if supported.
• Confirm the collector can maintain a stable connection to the FortiGate management IP.

Step 7: Validate Backup Access Manually

From the Auvik collector:

1. Test SSH and/or HTTPS access to the FortiGate management IP.
2. If using SSH, connect to the FortiGate over the VPN.
3. Run a configuration command:
   • show
   • show full-configuration

Confirm:

• The connection completes successfully.
• The session does not disconnect.
• No interactive banner, prompt, or authentication challenge prevents automated access.

Check the FortiGate logs for denied SSH or HTTPS management sessions.

Then:

• Trigger or wait for a configuration backup in Auvik.
• Confirm the latest backup timestamp updates.

Step 8: Validate Credentials and Backup Configuration

• Confirm the Auvik credentials match the FortiGate account being used.
• Verify the account has the required permissions for configuration backup.
• If using the FortiGate API, confirm the API token is active and the API admin profile has the required permissions.
• Review backup or integration logs for authentication failures, denied requests, or connection errors.

Best Practices

• Deploy an Auvik collector within the remote site when possible.
• Avoid relying on VPN for management traffic when a local collector is available.
• Schedule backups during low network utilization periods.
• Keep FortiOS versions up to date.
• Keep routing, NAT, firewall, Local-In Policy, and trusthost rules consistent with the collector’s actual source IP.

Changes to FortiGate interfaces, routes, NAT, firewall policies, Local-In Policies, trusthost restrictions, and VPN configuration should be performed by an authorized network or FortiGate administrator.