Loading_
Loading_
Backs up every FortiGate on a schedule, normalises the volatile lines, commits to git and posts a readable diff to Teams when the running config changes.
#Requires -Version 7.0<#.SYNOPSIS Backs up FortiGate configs, normalises volatile lines, commits to git and posts a readable diff to Teams on change. .DESCRIPTION Uses the FortiOS REST API with an API token per device. Normalisation is the important part: without it every diff is 100% noise and nobody reads the second one. .EXAMPLE .\Backup-FortiGate.ps1 -InventoryPath .\fortigates.json -RepoPath C:\configs#>[CmdletBinding()]param( [Parameter(Mandatory)] [string] $InventoryPath, [Parameter(Mandatory)] [string] $RepoPath, [string] $TeamsWebhook, [switch] $SkipTlsCheck) $ErrorActionPreference = "Stop" # Lines that differ on every dump and mean nothing$VolatilePatterns = @( '^#conf_file_ver=' '^\s*set (last-login|login-time|password-expire|passwd-time) '128 more lines behind the library licence
Backup-FortiGate.ps1 · 5.6 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
A FortiGate config backup that nobody diffs is a file, not a control. The problem is that raw configs differ on every dump — timestamps, session counters, certificate serials — so a naive diff is 100% noise.
This normalises the volatile lines before committing, so the git history contains only real change. That history then answers the question that actually matters during an incident: what changed on this firewall, and when.
Each run commits with the config revision and the admin who made the last change, pulled from the device itself, so the git log attributes changes to a person rather than to the backup service account.
| Name | Type | Required | Description |
|---|---|---|---|
InventoryPath | path | Required | JSON inventory with host and API token per device. |
RepoPath | path | Required | Git repository for the configs. |
TeamsWebhook | url | Optional | Post a diff summary on change. |
The platform turns any script into a governed automation — versioned, gated, audited and reversible.