Skip to content
ConfigProofDocumentation
Open workspace
Guide navigation
Manual export

Export a FortiGate by hand

Upload the configuration backup, one analysis per VDOM.

On this page

Get the configuration

Upload the configuration backup (.conf) exactly as the FortiGate wrote it. Its first line starts with #config-version=, which gives the model, the FortiOS release and the VDOM mode.

Or capture it over SSH at the top level, not inside config global, which prints only the global part:

FortiOS CLI
show full-configuration | grep .
  • Save only the output. The first line must be the #config-version= header or a config line: a prompt line or get system status above it refuses the file.
  • A capture without the header must hold config system global, config system admin, config system interface and config firewall policy in every VDOM, and its model and release are not read.

Several VDOMs

A multi-VDOM backup opens a picker. Each VDOM is its own analysis, at most 50 at once.

What the upload is read for

  • The configuration of each VDOM, with the global settings.
  • The HA configuration (config system ha).
  • Hostname, and from the header the model and FortiOS release.

A backup does not carry the serial number.

Through the Relay

ReadingCommand
Serial, model and versionget system status
License and FortiGuard contract state (SSH)diagnose autoupdate versions on a single-VDOM FortiGate; on multi-VDOM only the License Status line of get system status
Routing table (single VDOM)get router info routing-table all, get router info6 routing-table
LLDP neighborsREST API /api/v2/monitor/network/lldp/neighbors and /api/v2/monitor/network/lldp/ports
Interface link state (single VDOM, Relay)REST API /api/v2/monitor/system/interface

Upload

  1. Open New analysis

    Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.

  2. It is sent at once

    One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.

  3. Answer the picker if asked

    A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.

Operational CLI commands

Routes and routing neighbors, VDOM
get router info routing-table all
get router info6 routing-table
get router info bgp summary
get router info ospf neighbor
get router info6 ospf neighbor
get router info bfd neighbor
NAT and security policy, VDOM
show firewall policy
show firewall vip
show firewall ippool
show firewall central-snat-map
VPN and interfaces, VDOM
get vpn ipsec tunnel summary
get system interface
get system arp
System and high availability
get system status
get system ha status
Report evidence and rule hit counts

FortiGate. Available sources across collection methods

FortiGate policy hits require single-VDOM collection through Relay REST.

firewall policy
Relay: Counting window unavailable.

Hit counters without a supported source: proxy policy, security policy, central snat, dos policy, local in policy, multicast policy, shaping policy, router policy.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks
Active routes, Route decisions, VPN and NAT, Remote access, Lifecycle dates, Configuration history, Reachability, Rule dependencies
Checks not yet supported
CDP / LLDP, Tunnel, BGP and interface state, HA state, Recommended release, Change attribution, Pending changes

Related guides

Collect a FortiGateExport FortiManager by hand