Backing up the system

Fortinet recommends that you back up your FortiAnalyzer configuration to your management computer on a regular basis to ensure that, should the system fail, you can quickly get the system back to its original state with minimal affect to the network. You should also back up your configuration after making any changes to the FortiAnalyzer configuration or settings that affect connected devices.

Fortinet recommends backing up all configuration settings from your FortiAnalyzer unit before upgrading the FortiAnalyzer firmware. See Updating the system firmware.

An MD5 checksum is automatically generated in the event log when backing up the configuration. You can verify a backup by comparing the checksum in the log entry with that of the backup file.

Perform a system backup

To back up the FortiAnalyzer configuration:

1. Go to Dashboard.
2. In the System Information widget, click the backup button next to System Configuration. The Backup System dialog box opens.
3. Select the Backup Now tab.
4. If you want to encrypt the backup file, enable the Encryption option, then type and confirm the password you want to use. The password can be a maximum of 63 characters.
5. Select OK and save the backup file on your management computer.

Scheduling automatic backups

You can configure FortiAnalyzer to automatically backup your configuration on a set schedule.

To schedule automatic backup in the GUI:

1. Go to Dashboard.
2. In the System Information widget, click the backup button next to System Configuration. The Backup System dialog box opens.
3. Select the Schedule Backup tab.
4. Enable the Enable Schedule Backup option, and configure the options including the backup location, backup frequency, and an encryption password.
5. Click OK.

To schedule automatic backup in the CLI:

1. In the FortiAnalyzer CLI, enter the following command:

   config system backup all-settings

2. Configure the backup settings:

   set status {enable | disable}

   set server {<ipv4_address>|<fqdn_str>}

   set user <username>

   set directory <string>

   set week_days {monday tuesday wednesday thursday friday saturday sunday}

   set time <hh:mm:ss>

   set protocol {ftp | scp | sftp}

   set passwd <passwd>

   set crptpasswd <passwd>

   end

For example, the following configuration uses the FTP protocol to backup the configuration to server 172.20.120.11 in the /usr/local/backup directory every Monday at 1:00pm.

config system backup all-settings

set status enable

set server 172.20.120.11

set user admin

set directory /usr/local/backup

set week_days monday

set time 13:00:00

set protocol ftp

end

For more information, see the FortiAnalyzer CLI Reference Guide on the Fortinet Documents Library.

View backup history

After performing backups, you can view the backup history to see all backups performed on the FortiAnalyzer.

To see backup history:

1. Go to Dashboard.
2. In the System Information widget, click the backup button next to System Configuration. The Backup System dialog box opens.
3. Select the Backup History tab.
   The backup history displays the Date & Time, Admin, Size and Status of each backup.

MD5 checksum

To find the MD5 checksum generated with the backup:

1. In the GUI, go to System Settings > Event Log.
2. In the Changes column for the event log, note the MD5 checksum.

Perform backups using SCP

You can use secure copy protocol (SCP) with a SSH certificate to back up the FortiAnalyzer system configuration.

The following is an example of SSH certificate generation to be used with SCP for configuration backup. This example uses RSA but can also be applied to ED25519 keys.

To configure a SSH certificate for backup using SCP:

1. Create a SSH CA user key pair.

   ssh-keygen -t rsa -b 4096 -f ~/.ssh/ssh_user_ca

2. Create a SSH CA host key pair.

   ssh-keygen -t rsa -b 4096 -f ~/.ssh/ssh_host_ca

3. Copy the CA host ssh_host_ca* to /etc/ssh/.
4. Sign the user's public key using the host CA key.

   ssh-keygen -s ~/.ssh/ssh_host_ca -I qa -n qa -V +52w ~/.ssh/ssh_user_ca.pub

   ssh-keygen -Lf ~/.ssh/ssh_user_ca-cert.pub

   /root/.ssh/ssh_user_ca-cert.pub:

   Type: ssh-rsa-cert-v01@openssh.com host certificate

   Public key: RSA-CERT SHA256:/Ue4vx5n2oUp+XhwLuAkadsfa0YTt7dpuZgbZ8TBNuw

   Signing CA: RSA SHA256:/Ue4vx5n2oUp+XhwLuAkIkvadfadTt7dpuZgbZ8TBNuw (using rsa-sha2-512)

   Key ID: "qa"

   Serial: 0

   Valid: from 2023-09-25T14:24:00 to 2024-09-23T14:25:08

   Principals: qa

   Critical Options: (none)

   Extensions: (none)

5. Edit the SSH server config file at /etc/ssh/sshd_config and make the TrustedUserCAKeys directive to point to the user CA public key.

   TrustedUserCAKeys /etc/ssh/ssh_host_ca.pub

6. Restart the sshd process to make the configuration change take effect..

   systemctl restart sshd

7. On FortiAnalyzer, configure the SSH certificate.

   config sys certificate ssh

   edit ssh_cert_1

   set certificate "ssh_user_ca-cert.pub"

   set private "ssh_user_ca"

   end

8. Configure backup of all settings using SCP .

   execute backup all-settings scp <server IP> <path and file name> <username> <ssh-cert>

For more information on configuration of backup settings in the FortiAnalyzer CLI, see the FortiAnalyzer CLI Reference.