๐ FortiGate ่ชๅๅๅไปฝ + ็ๆฌๆฏๅฐๅฏฆๆฐ：ๆ็จ、CLI、ๅทฎ็ฐๆชขๆฅๅฎๆดๆๅ
ๅจไผๆฅญ็ฐๅขไธญ，FortiGate ๆฎๆผ็ๆฏๆดๅ็ถฒ่ทฏๅบๅ
ฅๅฃ่ Gateway ๅฎๅ
จๆ ธๅฟ，
ไปปไฝไธๆข Policy、่ทฏ็ฑ、็ฉไปถๆ VPN ่จญๅฎๆน้ฏ，้ฝๅฏ่ฝ็ดๆฅๅฝฑ้ฟๆดๅๅ
ฌๅธไธ็ถฒ่ๆๅๅญๆดป。
ๅฆๆ้ไบ่จญๅฎๆฒๆๅๅฅฝ「ๅฎๆๅไปฝ + ็ๆฌๅทฎ็ฐๆฏๅฐ」，็ถๆๅคฉๅบ็พ้ฃ็ท็ฐๅธธๆๅฎๅ
จไบไปถ，
ๆณๅ้ ญๆพ「ๅฐๅบๆฏ่ชฐ、ๅจไป้บผๆๅๆนไบไป้บผ」ๅฐฑๆ้ๅธธ็่ฆ。
ๆฌๆๆๅฏฆไฝไธๅฅๅฏ่ฝๅฐ็ๆต็จ：ๅฉ็จ FortiGate CLI ๅฏๅบ่จญๅฎๆช，
ๅๆญ้
Linux ็ฎก็ไธปๆฉ + ๆ็จ + git ่ชๅๅๅไปฝ，ไธฆ็จ Diff ๅทฅๅ
ทๆชขๆฅๅทฎ็ฐ，
่ฎ FortiGate ่จญๅฎไน่ฝไบซๅ้กไผผ「็จๅผ็ขผ็ๆฌๆงๅถ」็็ฎก็ๆนๅผ。
๐ ไธ、ๆด้ซๆถๆง่่จญ่จๆ่ทฏ
ๅ ็จไธๅผต็ฐกๅๆถๆงๅ่ชชๆๆต็จ：
┌──────────────────────────────┐
│ Linux ็ฎก็ไธปๆฉ（Backup） │
│ - ssh key ็ปๅ
ฅ FortiGate │
│ - ๆ็จๅไปฝ（cron / systemd） │
│ - git ็ฎก็็ๆฌ + Diff │
└───────────▲──────────────────┘
│
ssh / scp │
│
┌───────┴────────┐
│ FortiGate ้ฒ็ซ็ │
│ - CLI ๅทฒ้ๅ │
│ - ็ฎก็ๅธณ่ │
└─────────────────┘ๅฏฆไฝ็ฎๆจ：
- ๆฏๅคฉ่ชๅๆไธไปฝ่จญๅฎๆชๅ็ฎก็ไธปๆฉ。
- ไพๆฅๆๅฝๅ่ๆพ้ฒ git repository ไธญ็ฎก็。
- ้้ git diff / VS Code / Beyond Compare ็ญๅทฅๅ ทๆชขๆฅๅทฎ็ฐ。
- ๅฟ ่ฆๆๅฏๅฟซ้้ๅๅฐๆญทๅฒ็ๆฌ่จญๅฎ（ๆๅๆๅ่ชๅ）。
๐งฐ ไบ、FortiGate CLI ่จญๅฎๅไปฝๆนๅผ็ธฝ่ฆฝ
FortiGate ๆฌ่บซๆฏๆดๅค็จฎๅไปฝๆนๅผ：
- Web GUI：ๆๅไธ่ผ่จญๅฎๆช（ๅ ๅฏ / ๆชๅ ๅฏ）。
- CLI：
execute backup config ...ๅไปฝๅฐ TFTP / FTP / SCP / USB。 - ้กฏ็คบ่จญๅฎ：
show full-configuration，ๅฏ็ดๆฅ็ถ็ดๆๅญ็ๆฌไฝฟ็จ。 - ๆฐ็ๅฏๆญ้ Automation / Script，ไฝไปๅปบ่ญฐ็ฑๅค้จ็ฎก็ไธปๆฉ็ตฑไธๆง็ฎก。
ๆฌๆไธป่ปธๆไฝฟ็จ：
- ๆนๅผ A：Linux ็ฎก็ไธปๆฉไปฅ SSH ็ปๅ
ฅ FortiGate，ๅท่ก
show full-configuration，ๅฐ่ผธๅบๅฐๅ ฅๆชๆก。 - ๆนๅผ B：ๅจ FortiGate ไธๅท่ก
execute backup config scp/ TFTP，่ชๅๆจๅ็ฎก็ไธปๆฉ。
๐ก ไธ、ๆนๅผ A：SSH + show full-configuration（ๆ็ด่ฆบๅฅฝ Diff）
1. ๅปบ็ซ FortiGate ็ฎก็ๅธณ่（ๅปบ่ญฐ）
ๅจ FortiGate CLI ไธญๅปบ็ซไธๅๅฐ็จ็ๅไปฝๅธณ่，ไพๅฆ backup：
config system admin
edit "backup"
set accprofile "read-only"
set vdom "root"
set password <strong-password>
next
end่ฅ้่ฆๅฏๅบๅฎๆด่จญๅฎ（ๅ ๅซๆๆ่ณ่จ），ๆฌ้ๅฏ่ฆๆ ๆณ่ชฟๆด็บๆด้ซ็ดๅฅ，ไฝๅปบ่ญฐๅ ้ๅๅฟ ่ฆๆฌ้，ไธฆ้ๅถไพๆบ IP。
config system admin
edit "backup"
set trusthost1 10.0.10.0 255.255.255.0
next
end2. ๅจ Linux ็ฎก็ไธปๆฉ็ข็ SSH ้้ฐไธฆ่ค่ฃฝๅฐ FortiGate
# ็ฎก็ไธปๆฉ็ข็้้ฐ
ssh-keygen -t ed25519 -f ~/.ssh/fortigate_backup -C "fortigate-backup"
# ๅฐ public key ่ฒผๅฐ FortiGate ๅธณ่่จญๅฎไธญ
# (ๅฏๅจ GUI > System > Administrators > backup > SSH public key)
่จญๅฎๅฎๆๅพ，ๆธฌ่ฉฆๅพ็ฎก็ไธปๆฉๅ ๅฏ็ขผ็ปๅ ฅ：
ssh -i ~/.ssh/fortigate_backup backup@10.0.0.2543. ๆฐๅฏซๅไปฝ่ ณๆฌ：ๆๅๅฎๆด่จญๅฎไธฆไธ้ฒ git
ๅจ็ฎก็ไธปๆฉๅปบ็ซไธๅๅฐ็จ็ฎ้，ไพๅฆ /opt/fortigate-backup：
sudo mkdir -p /opt/fortigate-backup
sudo chown $(whoami): /opt/fortigate-backup
cd /opt/fortigate-backup
git initๅปบ็ซ shell script，ไพๅฆ backup_fgt.sh：
#!/bin/bash
set -e
FGT_HOST="10.0.0.254"
FGT_USER="backup"
SSH_KEY="$HOME/.ssh/fortigate_backup"
TODAY=$(date +"%Y-%m-%d_%H%M")
OUTDIR="/opt/fortigate-backup/configs"
mkdir -p "$OUTDIR"
OUTFILE="${OUTDIR}/fortigate_${FGT_HOST}_${TODAY}.conf"
# 1) ้้ SSH ๅท่ก show full-configuration
ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no \
${FGT_USER}@${FGT_HOST} \
'show full-configuration' > "$OUTFILE"
# 2) ๅปบ็ซ/ๆดๆฐๆๆฐ symlink ๆนไพฟๅฟซ้ๆฅ็
ln -sfn "$OUTFILE" "${OUTDIR}/fortigate_${FGT_HOST}_latest.conf"
# 3) ๅ ๅ
ฅ git ็ๆฌๆงๅถ
cd /opt/fortigate-backup
git add "$OUTFILE"
git commit -m "Backup ${FGT_HOST} at ${TODAY}" || echo "No change to commit"
่จๅพ็ตฆๅท่กๆฌ้：
chmod +x /opt/fortigate-backup/backup_fgt.sh4. ๅฉ็จ cron ๆ็จๆฏๆฅๅไปฝ
crontab -eๅ ๅ ฅๆฏๅคฉๅๆจ 03:10 ๅท่กไธๆฌก：
10 3 * * * /opt/fortigate-backup/backup_fgt.sh >/tmp/backup_fgt.log 2>&1้ๆจฃๅฐฑๅฎๆ「ๆฏๅคฉๅพ FortiGate ๆไธไปฝๅฎๆด่จญๅฎ、ไธ้ฒ git repository ่ฃก」็่ชๅๅๆต็จ。
๐พ ๅ、ๆนๅผ B：FortiGate ่ชๅๆจ้่จญๅฎ（execute backup config ...）
ๅฆไธ็จฎๅๆณๆฏ่ฎ FortiGate ไธปๅๆ่จญๅฎๆจๅฐ TFTP / FTP / SCP ไธปๆฉ：
1. CLI ๆๅๅไปฝๅฐ TFTP（็คบๆ）
execute backup config tftp FGT-01_$(get system time).conf 10.0.10.10ไธๅ FortiOS ็ๆฌๆไปค็ฅๆๅทฎ็ฐ，ๅธธ่ฆๆ ผๅผ็บ：
execute backup config tftp <filename> <server-ip>execute backup config ftp <filename> <server-ip> <user> <password>execute backup config scp <filename> <user>:<server-ip>:<path>（่ฆ็ๆฌๆฏๆด）
ๅฏฆๅไธๅฏไปฅๆญ้ Script / Automation Profile ๅฎๆๅท่ก，ไธ้ๅคๆธๆ ๆณ้ๆฏๅปบ่ญฐ็ฑๅค้จ็ฎก็ไธปๆฉ็ตฑไธๆ็จ่็ๆฌๆง็ฎก，ๆฏ่ผๅฅฝ้ไธญ็ฎก็。
๐งช ไบ、Diff：ๅฟซ้ๆพๅบ「่ชฐๆนไบไป้บผ」
ๆไบๆฏๆฅๅไปฝๆชๅพ，ไธไธๆญฅๅฐฑๆฏ「ๆฏ่ผๅทฎ็ฐ」。
1. ไฝฟ็จ git log / git diff
cd /opt/fortigate-backup
# ๆฅ็ๆญทๅฒๅไปฝ็ด้
git log --oneline --graph
# ๆฏ่ผๆ่ฟๅ
ฉๆฌกๅไปฝๅทฎ็ฐ
git diff HEAD~1 HEAD
# ๆๅฎๆๅ
ฉๅๆ้้ป็ๅทฎ็ฐ
git diff <commit-id-1> <commit-id-2>
ๆญ้ VS Code / Beyond Compare ็ญ GUI ๅทฅๅ ท，ๅฏไปฅๆด็ด่ฆบๅฐ็ๅฐๆฏๆข policy、็ฉไปถ、่ทฏ็ฑ็ๆฐๅข、ๅช้ค่ไฟฎๆน。
2. ็ดๆฅ็จ diff ๆฏ่ผๅ ฉๅๆชๆก
diff -u fortigate_10.0.0.254_2025-12-01_0310.conf \
fortigate_10.0.0.254_2025-12-03_0310.conf | lessไฝฟ็จ -u ๆ้กฏ็คบไธไธๆ，ๆๅฉๆผ้ฑ่ฎ。
๐ก ๅ ญ、ๅฎๅ จๆง่ๆฌ้ๆง็ฎกๅปบ่ญฐ
FortiGate ่จญๅฎๆชไธญๅฏ่ฝๅ ๅซ：
- VPN ๅธณ่ๅฏ็ขผ
- ็ฎก็ไป้ข่จญๅฎ
- ๅ ง้จ็ถฒๆฎต็ตๆง่ๆๆจธ
ๅ ๆญค，ๅฐๅไปฝไธปๆฉ่ git repository ่ฆ็นๅฅๆณจๆ：
- ๅไปฝ็ฎ้ๆฌ้้ๅถ，ไพๅฆ
chmod 700 /opt/fortigate-backup。 - ่ฅๆจๅฐ้ ็ซฏ git server，ๅปบ่ญฐๆถๅจๅ ง็ถฒๆ็งๆ GitLab / Gitea，ไธ่ฆๅ ฌ้。
- ๅฟ ่ฆๆๅฏๅ็จ GPG ็ญๆนๅผๅ ๅฏ่จญๅฎๆช，่งฃๅฏๆฌ้ๅ ้ๅฐๆธ็ฎก็่ 。
- ็ฎก็ไธปๆฉๆฌ่บซ้ๅๅฅฝ็กฌ็ขๅ ๅฏ่็ปๅ ฅๆง็ฎก。
๐งฏ ไธ、้ๅ（Restore）่ๅฏฆๅๅปบ่ญฐ
ๅไปฝๅชๆฏ็ฌฌไธๆญฅ，้้ตๆฏ「็็่ฝ้ๅ」。
- ๅฎๆๅจ Lab / ๆธฌ่ฉฆๆฉๅจไธๅฏฆ้ๆธฌ่ฉฆๅฏๅ ฅ่จญๅฎๆช。
- ้ๅฐ้ๅคง่ฎๆด（ไพๅฆ Gateway / Routing ๅคง่ชฟๆด）ๅ，ๆๅๅไธไปฝ้กๅคๅไปฝไธฆๆจ่จป。
- ๅฆๆๅคๅฐ FortiGate（HQ + Branch），่จๅพๅๅฅๅปบ็ซไธๅๅญ็ฎ้่ๅฝๅ่ฆๅ。
็ฐกๅฎๅปบ่ญฐๅฝๅๆนๅผ：
/opt/fortigate-backup/configs/
├── FGT-HQ_2025-12-03_0310.conf
├── FGT-BR1_2025-12-03_0310.conf
└── FGT-DC_2025-12-03_0310.conf้ ๅ git tag ่จป่จ้่ฆ็ฏ้ป，ไพๅฆ：
git tag -a "before-dc-migration" -m "DC ็ถฒ่ทฏๆน็ๅๆๅพ็ๆฌ"
git push --tags๐ ๅ ซ、FortiGate ่จญๅฎๅไปฝ + Diff ๅฏฆไฝ Checklist
✅ ๅจ FortiGate ๅปบ็ซๅฐ็จๅไปฝๅธณ่（้ๅถไพๆบ IP）
✅ ๅจ Linux ็ฎก็ไธปๆฉๅปบ็ซ SSH ้้ฐไธฆๆธฌ่ฉฆๅ
ๅฏ็ขผ็ปๅ
ฅ
✅ ๆฐๅฏซ backup_fgt.sh ่ชๅๆๅ show full-configuration
✅ ไปฅๆฅๆ่่จญๅไปฃ่ๅฝๅๅไปฝๆช
✅ ไฝฟ็จ git ็ฎก็ๅไปฝ็ๆฌ（git add & commit）
✅ ่จญๅฎ cron / systemd timer ๆฏๆฅๆ็จๅท่ก
✅ ๅฎๆไฝฟ็จ git diff / diff / GUI ๅทฅๅ
ทๆชขๆฅๅทฎ็ฐ
✅ ็ขบ่ชๅไปฝไธปๆฉ่ repository ๆฌ้็ฎกๆงๅฎๅ
✅ ไธๅฎๆๅฏฆ้ๆธฌ่ฉฆ Restore ่้ๅๆต็จ๐ฌ ไบๅ็่จๅผๅฐ（FortiGate ๅไปฝ / Diff ๅฏฆๆฐๅไบซๅ）
ๅฆๆไฝ ๅจๅฏฆไฝ FortiGate ่ชๅๅๅไปฝ、ๆ็จๆ Diff ็้็จไธญ้ๅฐ：
- SSH ้้ฐ็ปๅ ฅๅก้ๆไธ่ฝๅ ๅฏ็ขผ
- show full-configuration ่ผธๅบไธๅฎๆดๆไธญ้่ขซๆชๆท
- ๅคๅฐ FortiGate ไธ็ฅ้ๅฆไฝ่จญ่จๅฝๅ่็ฎ้็ตๆง
- ๆณๆๅไปฝ่ๅ ถไป่จญๅ（ไพๅฆ Switch / Router）ไธ่ตท็ฎก็
ๆญก่ฟๅจไธๆน็่จไฝ ็ FortiGate ๅ่、FortiOS ็ๆฌ่็ฎๅๅๆณ， ๆๆๆๆไปฃ่กจๆง็ๆกไพๆด็ๆ่ฃๅ ็ฏๆดๆฐๅจๆฌๆ，่ฎ้ๅฅๅไปฝ + Diff ๆต็จๆดๅฎๆด。
๐ ๅปถไผธ้ฑ่ฎ
- ๐งฐ FortiGate CLI ๅฏฆๆฐ：ๅบๆฌ่จญๅฎ、ๅธธ็จๆ้ฏๆไปค่ๅๆดๆชขๆฅ
- ๐ก FortiGate Policy ่จญ่จๆไฝณๅฏฆๅ：็ฉไปถ、็พค็ต่่ฆๅๆๅบ็ญ็ฅ
- ๐ Linux + git ่จญๅฎ็ฎก็：้ไธญ็ฎก็้ฒ็ซ็ / Switch / Router ๅไปฝ
- ๐ก Linux ๅฎๅ จๅผทๅ：SELinux / AppArmor / Auditd / Fail2Ban ๅฎๆดๆๅ
- ๐ GoAccess + Nginx/Apache Dashboard ๆๅญธ：ๅณๆ Web Log ๅๆ่ๅฎๅ จไบไปถ่งๅฏ
— WWFandy・FortiGate Backup & Diff Notes
ๆฒๆ็่จ:
ๅผต่ฒผ็่จ