Fortinet

This guide covers FortiGate firewalls running FortiOS and FortiWLC wireless controllers.

FortiGate / FortiOS

Create a backup account. FortiOS supports read-only administrator profiles, which are sufficient for QUARK. First create a read-only access profile, then the administrator:

config system accprofile
    edit "netwatch-readonly"
        set sysgrp read
        set netgrp read
        set fwgrp read
        set vpngrp read
        set utmgrp read
        set loggrp read
    next
end
config system admin
    edit "netwatch-backup"
        set accprofile "netwatch-readonly"
        set password <password>
        set trusthost1 <collector-ip> 255.255.255.255
    next
end

The trusthost1 entry restricts where the account may log in from; set it to the Netwatch collector's IP.

Enable SSH. Allow SSH on the interface the collector will reach:

config system interface
    edit <mgmt-interface>
        append allowaccess ssh
    next
end

Notes.

• On units with multiple VDOMs, create the administrator with global scope so the entire configuration (all VDOMs) is visible to the account.
• Read-only profiles can display the full configuration; private keys and some secrets are shown encrypted, which is expected and still restores correctly.
• If you use the equivalent web UI workflow, the paths are System > Admin Profiles and System > Administrators.

FortiWLC

FortiWLC runs on the former Meru wireless controllers.

Create a backup account. Create a dedicated netwatch-backup administrator in the controller's user management (web UI or CLI). FortiWLC does not provide a read-only level that can display the complete configuration, so grant full administrator rights.

Enable SSH. SSH management access is normally enabled on the controller's management interface; verify it is reachable from the Netwatch collector and, if you filter management access, permit the collector's IP.

Notes. QUARK reads the controller's saved configuration with show commands only. Controller-managed access points do not need any preparation — their configuration is contained in the controller backup.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.