Troubleshooting FortiGate Configuration Backups: Return Code 5

Overview

FortiGate configuration backups may fail even when Auvik can access the device.

This article covers the error:

Send config file to ftp server via vdom root failed. Command fail. Return code 5.

Required FortiGate permissions

The FortiGate credentials used for backups must have permissions to:

Access the running configuration.
Execute configuration backup or export commands.
Read system configuration.
Read the required VDOM configuration.

Common causes

Return code 5 may occur when:

The FortiGate cannot route to the backup destination.
The wrong source interface or management VDOM is being used.
A firewall policy blocks FTP, SFTP, or SSH traffic.
DNS resolution fails.
The backup server address or port is incorrect.
Authentication fails on the destination server.
The destination account cannot write to the target path.
A proxy or inspection policy interferes with the connection.

Troubleshooting

These steps require FortiGate and network administrator access.

1. Confirm the transfer method

Identify the backup method being used:

FTP
TFTP
SFTP or SSH

Record the destination server IP address or hostname, port, target path, and filename.

2. Test reachability from the correct VDOM

From the FortiGate CLI, run the tests from the VDOM used for the backup.

To test DNS resolution:

diagnose test application dnsproxy 6 <server FQDN>

To test reachability:

execute ping <server IP>

To test the route:

execute traceroute <server IP>

3. Verify routing and source settings

Confirm that:

The management VDOM is configured correctly.
The egress interface has a route to the backup server.
Return traffic can reach the FortiGate.
The expected source interface or IP is used.
Firewall policies allow the backup traffic.

4. Test the destination protocol

For FTP, test port 21 if supported:

execute telnet <server IP> 21

For SFTP or SSH, test port 22:

execute telnet <server IP> 22

Confirm that the destination server is listening on the expected port.

5. Verify destination credentials and permissions

Confirm that:

The username and password or key are correct.
The destination account can write to the target directory.
The target path exists.
FTP passive mode is enabled if required.
Any required proxy or inspection exemption is configured.

6. Run a manual backup

Run an on-box backup using the same protocol, destination, path, and credentials used by the backup process.

Example format:

execute backup config <protocol> <server> <path/filename> <username>

Record the complete output, including any error message or return code.

A successful manual backup confirms that the FortiGate can reach the destination and write the configuration file.

FTP over MPLS or VPN

When the backup uses FTP from the FortiGate to the Auvik Collector, confirm the following conditions:

The management VDOM has a route to the Collector IP or subnet.
The route uses the expected MPLS or VPN interface.
An explicit policy allows traffic from the FortiGate management interface or zone to the Collector on TCP port 21.
The Collector FTP service is active and listening on port 21.
The Collector host firewall and any intermediate firewall allow inbound TCP port 21.
The FortiGate account used for the backup has sufficient privileges to run configuration backup or export commands. On many FortiOS versions, the Auvik SSH user must use the super_admin profile.

Test connectivity from the FortiGate

These tests must be performed by an authorized FortiGate administrator.

Identify the management VDOM and enter the correct VDOM context.
Test reachability to the Collector:
- Run a ping test.
- Run a traceroute test.
- Confirm the traffic follows the expected MPLS or VPN path.
Test FTP connectivity to the Collector on TCP port 21.
A successful connection should return an FTP 220 service banner.
Confirm that the VDOM routing table contains a valid route to the Collector IP.
If necessary, run a packet capture on the FortiGate while retrying the backup to determine whether the connection is being attempted, blocked, or rejected.

Common fixes

Add or correct the route in the management VDOM.
Update the MPLS or VPN policy to permit the Collector traffic.
Add an explicit firewall policy allowing TCP port 21.
Confirm that the Collector FTP service is active.
Allow inbound TCP port 21 through the Collector host firewall.
Assign the required FortiGate permissions to the Auvik SSH user.
Retry the configuration backup after the changes are applied.

If CLI and FTP backups continue to fail

If the FortiGate and Auvik environment support API-based backups, configure the FortiGate REST API integration instead. Use a REST API administrator with the permissions required to export the configuration.

If routing, FTP, and permissions are confirmed but the error continues, contact Fortinet Support to review VDOM, MPLS/VPN, or FortiGate FTP client and server constraints.

Collect Collector logs

If the issue continues, an authorized Windows Collector administrator can collect additional logs:

Open Command Prompt as Administrator.
Navigate to the Auvik installation directory, such as C:\Auvik.
Run:
AuvikAgentService -shell
Use the shell help command to determine whether verbose backup logging is available.
Reproduce the backup attempt.
Collect the generated logs from the Collector installation directory.

Remove passwords, API tokens, private keys, and other sensitive information before sharing logs.

Contact Support

If the backup continues to fail, provide:

FortiGate model and FortiOS version.
Auvik site name.
Backup method and destination.
Destination IP, port, and path.
VDOM and source-interface details.
Timestamp of the failed test, including time zone.
Complete FortiGate error output.
Results of the reachability and protocol tests.
Collector logs with sensitive values removed.

Changes to FortiGate permissions, VDOMs, routing, firewall policies, proxy rules, and backup destinations must be performed by an authorized administrator.

How can we help?