Backing up and restoring the FortiGate-VM configuration

Back up your FortiGate-VM configuration regularly to protect against data loss and to simplify migration between deployments. You can back up and restore the configuration by using the FortiGate web console or the CLI.

IBM does not back up your FortiGate-VM configuration. You are responsible for maintaining backups and storing them securely.

Before you begin

Make sure that the following conditions are met before you backup or restore:

  • Be logged in to the FortiGate web console as an administrator. See Accessing your FortiGate firewall.
  • If you are restoring a configuration to a different instance, make sure that the target instance is running the same or a compatible FortiOS version.
  • If you are restoring a configuration from a different deployment type (for example, from a Classic FortiGate or a different VPC instance), you must update interface names, IP addresses, and gateway references before you import. See Adapting a configuration for a new deployment.

Backing up the FortiGate-VM configuration in the console

To back up the FortiGate configuration in the console, follow these steps:

  1. Log in to the FortiGate web console.
  2. In the upper-right, click the admin username and select Configuration > Backup.
  3. In Backup to, select Local PC.
  4. If VDOMs are enabled, select whether to back up the Global configuration, a specific VDOM, or all VDOMs.
  5. (Optional) Enable Encrypt configuration file and enter a password to protect the backup file.
  6. Click Backup.

The configuration file is downloaded to your local system as a .conf file. Store it securely, as the file contains sensitive information including interface configurations, firewall policies, and VPN settings.

Backing up the FortiGate-VM configuration from the CLI

To back up the configuration from the CLI, run the following command over SSH:

execute backup config tftp <filename> <tftp-server-ip>

Replace <filename> with the wanted backup file name and <tftp-server-ip> with the IP address of your TFTP server. To back up to a USB drive (if supported by the instance type), use execute backup config usb <filename> instead.

Restoring the FortiGate-VM configuration in the console

To restore the FortiGate configuration in the console, follow these steps:

  1. Log in to the FortiGate web console.
  2. In the upper-right, click the admin username and select Configuration > Restore.
  3. In Restore from, select Local PC.
  4. Click Browse and select the .conf backup file.
  5. If the backup was encrypted, enter the password.
  6. If VDOMs are enabled, select the scope to restore (Global, a specific VDOM, or all VDOMs).
  7. Click Restore.

The FortiGate-VM restarts automatically after the restore completes. Log in again when the instance is back online to verify the configuration.

Restoring a configuration overwrites the current running configuration. Make sure that you have a backup of the current configuration before you restore.

Restoring the FortiGate-VM configuration from the CLI

To restore the configuration from the CLI, run the following command over SSH:

execute restore config tftp <filename> <tftp-server-ip>

Replace <filename> with the backup file name and <tftp-server-ip> with the IP address of your TFTP server.

Adapting a configuration for a new deployment

If you are restoring a configuration to a different FortiGate-VM instance (for example, when you change license plans or migrating from Classic to VPC), you must update these items before you import:

  • Interface names: VPC FortiGate-VM deployments use port1 and port2. Classic deployments can use different interface names. Update all references.
  • IP addresses and subnets: Replace all interface IPs, static routes, and gateway addresses with the values that correspond to the new VPC subnets.
  • HA settings: If you move from a single VM to an HA deployment, or between HA configurations, update the HA peer IP addresses, management interface, and heartbeat interface settings.
  • SDN connector: Update the IBM Cloud SDN connector API key and region to match the new deployment.

Edit the .conf file in a text editor before you import it. Search for the interface names and IP addresses from the original deployment and replace them with the correct values for the target deployment.

Unsupported backup methods

IBM Cloud VPC boot volume snapshots and whole-volume backups are not supported for FortiGate-VM licensed firewall instances.

Do not use VPC volume snapshots to back up or restore a firewall instance for the following reasons:

  • Licensing incompatibility: FortiOS registers a FortiFlex license specific to the original virtual server instance. A boot volume restored from a snapshot retains the previous instance's license registration, and FortiOS cannot automatically detect or acquire a new license on the new instance.
  • Bypassed deployment automation: Deploying directly from a snapshot bypasses the Terraform and cloud-init automation required to configure instance metadata, licensing services, and associated VPC networking resources.

To back up and restore your firewall, export the configuration .conf file as described in Backing up the FortiGate-VM configuration in the console. If you need to replace an instance, deploy a new firewall from the IBM Cloud catalog and import your configuration file.