Back Up and Restore a FortiGate Configuration the Safe Way

Before you run this

This guide backs up a FortiGate's running configuration to a file you can store off-box, and restores that file when you need to roll back or rebuild. A backup is harmless. A restore is not: restoring a full configuration overwrites everything on the unit and reboots it. If the file is for a different model or firmware, or was captured with private-data encryption you can't unlock, the restore can leave the box unreachable.

• Privileges: you need a FortiGate administrator with the super_admin profile, reaching the unit over the HTTPS GUI or SSH. This is not an OS-level sudo operation — there is no shell.
• Environment I assume: a hardware FortiGate on FortiOS 7.4, managed directly (not through FortiManager). Menu paths and CLI shifted between 6.x, 7.0, 7.2 and 7.4, so confirm against your build if you're on a different train.
• Test first: practise a restore on a spare unit or a VM of the same model and firmware before you ever restore a production box. Read a backup file in a text editor once so you know what it contains.
• Firewall-specific safety — do not skip:
  • Keep a console (out-of-band) connection open the whole time. A bad restore or a reboot into a wrong config can cut both management and production traffic; the console port is how you get back in.
  • Back up the current config before you restore a different one. That current backup is your rollback.
  • Do restores in a maintenance window — the unit reboots and drops traffic during the process.
  • Rollback path: re-restore the config you saved beforehand. On models with internal storage you can also revert to a stored config revision (see the last section).

---

What's actually in the backup

A FortiGate backup is a single plaintext file. The first line is a header like:

#config-version=FGT60F-7.4.4-FW-build2662-240514:opmode=0:vdom=0:...

That header names the model and firmware build. Fortinet's supported path is to restore a backup onto the same model on the same firmware version. Restoring across versions or models is unsupported and unpredictable — don't do it in production.

Two gotchas worth knowing before you rely on a file:

• Passwords and secrets (admin hashes, VPN PSKs, RADIUS keys) are stored encrypted with a per-device key by default. Restore to the same unit and they come back fine. Restore to a different unit and those secrets won't decrypt — you'd re-enter them.
• If you want a backup that's portable between units, enable private-data encryption (below) so secrets travel with a passphrase instead of the device key.

---

Back up from the GUI

1. Log in to the FortiGate HTTPS GUI as an admin.
2. Click your admin name in the top-right corner.
3. Choose Configuration → Backup.
4. Set Backup to = Local PC (or USB Disk if a stick is inserted).
5. Optionally turn on Encryption, then set and confirm a password. Store that password somewhere safe — there is no recovery if you lose it.
6. Click OK / Backup and save the file.

Name the file so you can tell what it is later, e.g. fgt-edge-7.4.4-2025-01-15.conf.

Back up from the CLI

Over SSH, the command is execute backup config. The common targets are TFTP, USB, and FTP/SFTP. Two examples:

# To a TFTP server on your management LAN
execute backup config tftp fgt-edge-7.4.4-2025-01-15.conf 192.0.2.10

# To a USB stick plugged into the unit
execute backup config usb fgt-edge-7.4.4-2025-01-15.conf

Replace the filename and 192.0.2.10 with your own. FTP and SFTP variants exist and take server, username and password arguments — check the exact argument order in the FortiOS CLI Reference rather than guessing it, since it differs by transport.

Making a portable, encrypted backup

If this backup might be restored onto a different unit (RMA, cold spare), enable private-data encryption so the secrets come with it. This is a global setting on the unit, and once enabled every backup requires the key to restore:

config system global
    set private-data-encryption enable
end

FortiOS then prompts you to enter and confirm the encryption key at the CLI. Record that key. Any backup taken while this is enabled cannot be restored without it. If you're not certain how your build handles the key prompt or key length, confirm in the FortiOS Administration Guide before enabling it on a production box — this is a setting you don't want to fumble.

For a one-off portable file, the GUI Encryption toggle in the backup dialog is the simpler route and doesn't change a global setting.

---

Restore — the part that reboots the box

Confirm two things first: the target unit is the same model, and it's running the same firmware as the backup's #config-version header. Have your console open and your pre-restore backup in hand.

From the GUI

1. Click your admin name (top-right) → Configuration → Restore.
2. Choose the source (Local PC or USB Disk) and select the file.
3. If the file is encrypted, enter its password.
4. Click OK and confirm.

The unit validates the file, applies it, and reboots. You'll lose the session; log back in after it comes up.

From the CLI

# From TFTP
execute restore config tftp fgt-edge-7.4.4-2025-01-15.conf 192.0.2.10

# From USB
execute restore config usb fgt-edge-7.4.4-2025-01-15.conf

The CLI asks you to confirm, then reboots. Do not interrupt power during the reboot.

---

Verify the backup

Before you trust a backup file, open it in a text editor and check:

• The first line shows the model and firmware you expect.
• The file ends cleanly and isn't truncated (a full config runs to thousands of lines; a few dozen lines means the transfer failed).
• If you used encryption, the body is unreadable ciphertext — that's correct.

Verify the restore

After the reboot, log back in over the console or GUI and confirm the unit is running what you intended:

get system status

Check the version and hostname match the restored config. Then spot-check the things that matter for your site — interfaces, the default route, and a key policy:

show system interface
get router info routing-table all
show firewall policy

Confirm production traffic is passing before you close the maintenance window and drop the console.

Undo / roll back

If the restored config isn't right, restore the pre-restore backup you took earlier using the same GUI or CLI steps above — that's your clean rollback.

On FortiGate models with internal storage, FortiOS can also keep configuration revisions on the unit, viewable and revertible from the GUI under the system settings area, and it can be told to save a revision automatically (for example on admin logout). The exact menu location and the CLI keywords that enable automatic revision backup vary by model and build, so check the FortiOS Administration Guide ("Configuration revisions" / "Configuration backup") for your version rather than assuming the option is present — smaller desktop units without storage don't offer it.

For the canonical, version-matched syntax and menu paths, the Fortinet Document Library at docs.fortinet.com hosts the FortiOS Administration Guide and CLI Reference for each release. Match the document to the firmware on your box before you follow it.