FortiGate firewall backup automation with Ansible

---
- name: Backup FortiGate Firewalls
  hosts: fortigates
  gather_facts: no
  connection: httpapi

  tasks:
    - name: Ensure local backup directory exists
      ansible.builtin.file:
        path: "{{ backup_dir }}"
        state: directory
        mode: '0755'
      run_once: true
      delegate_to: localhost

    - name: Backup FortiGate configuration
      fortinet.fortios.fortios_monitor_fact:
        selector: 'system_config_backup'
        params:
          scope: "{{ fortigate_backup_scope }}"
      register: backup_result
      ignore_errors: yes

    - name: Save configuration to file
      ansible.builtin.copy:
        content: "{{ backup_result.meta.raw }}"
        dest: "{{ backup_dir }}/{{ inventory_hostname }}_config_{{ backup_timestamp }}.conf"
        mode: '0640'
      delegate_to: localhost
      register: save_result
      when:
        - backup_result is succeeded
        - backup_result.meta.raw is defined

    - name: Find old backup files
      ansible.builtin.find:
        paths: "{{ backup_dir }}"
        patterns: ["*.conf", "*.txt"]
        age: "{{ retention_days }}d"
      register: old_backups
      delegate_to: localhost
      run_once: true

    - name: Remove old backups
      ansible.builtin.file:
        path: "{{ item.path }}"
        state: absent
      loop: "{{ old_backups.files }}"
      delegate_to: localhost
      run_once: true

---
# group_vars/all.yaml — global defaults (Global layer)
backup_dir: "./backups"            # safe path, no shell metacharacters
retention_days: 30                 # integer 1–3650
backup_timestamp: "{{ lookup('pipe', 'date +%Y-%m-%d_%H%M%S') }}"
backup_schedule: "0 2 * * *"       # 5-field cron — nightly at 02:00

---
# group_vars/fortigates/vars.yaml — connection + auth (Group layer)
ansible_network_os: fortinet.fortios.fortios
ansible_connection: httpapi
ansible_httpapi_use_ssl: true      # required true when port 443
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443          # 1–65535
ansible_command_timeout: 30        # 5–600
ansible_httpapi_timeout: 30        # 5–600

# Credentials: env lookup or Vault ref ONLY — never a literal secret
ansible_user: "{{ lookup('env', 'FORTIGATE_USER') }}"
ansible_password: "{{ lookup('env', 'FORTIGATE_PASSWORD') }}"
# Vault alternative:
# ansible_user: "{{ vault_fortigate_user }}"
# ansible_password: "{{ vault_fortigate_password }}"

fortigate_backup_scope: global     # global | vdom
fortigate_api_version: v2

---
# host_vars/fw-prod-01.yaml — per-device overrides (Host layer)
ansible_host: 192.168.1.10         # valid IPv4 or hostname
fortigate_site: "Headquarters - Main Data Center"   # required, ≤120 chars
fortigate_location: "Amsterdam, Netherlands"
fortigate_role: "Primary Internet Gateway"
fortigate_environment: production  # production | staging | lab | branch | dmz

# Optional overrides (fall back to group/global when omitted)
retention_days: 90                 # keep critical device backups longer
# ansible_httpapi_port: 8443

---
# group_vars/fortigates/vault.yaml — encrypted with: ansible-vault encrypt
vault_fortigate_user: "backup_svc"
vault_fortigate_password: "S3cure-Backup-Pass!"

---
# group_vars/fortigates/vars.yaml — reference the encrypted vault values
# (vars.yaml is plaintext; only vault.yaml is encrypted)
ansible_user: "{{ vault_fortigate_user }}"
ansible_password: "{{ vault_fortigate_password }}"

# Per-device override (host_vars/fw-dmz-01.yaml) — separate vault entry
ansible_user: "{{ vault_dmz_admin_user }}"
ansible_password: "{{ vault_dmz_admin_password }}"

# Create / edit the encrypted vault file
ansible-vault create group_vars/fortigates/vault.yaml
ansible-vault edit   group_vars/fortigates/vault.yaml

# Run the backup, supplying the vault password
ansible-playbook forti_backup.yaml --ask-vault-pass
# ...or from a protected password file
ansible-playbook forti_backup.yaml --vault-password-file ~/.vault_pass

# Env-var alternative (no vault) — schema also accepts these
export FORTIGATE_USER="backup_svc"
export FORTIGATE_PASSWORD="S3cure-Backup-Pass!"
ansible-playbook forti_backup.yaml

---
all:
  children:
    fortigates:
      children:
        production_fortigates:
          hosts:
            fw-prod-01: { ansible_host: 192.168.1.10 }
            fw-prod-02: { ansible_host: 192.168.1.11 }
        branch_fortigates:
          hosts:
            fw-branch-01: { ansible_host: 192.168.2.10 }
            fw-branch-02: { ansible_host: 192.168.3.10 }
        dmz_fortigates:
          hosts:
            fw-dmz-01: { ansible_host: 10.0.1.10 }

# Install prerequisites
pip3 install ansible fortiosapi
ansible-galaxy collection install -r requirements.yaml

# Set credentials
export FORTIGATE_USER="admin"
export FORTIGATE_PASSWORD="YourPassword"

# Backup all devices
ansible-playbook forti_backup.yaml

# Backup a single group or device
ansible-playbook forti_backup.yaml --limit production_fortigates
ansible-playbook forti_backup.yaml --limit fw-prod-01