Configure the FortiGate.
Enable SCP.
From CLI.

# config system global
set admin-scp enable
end

Enable SSH access on the interface
SCP uses SSH protocol to provide secure file transfer. The interface you use for administration must allow SSH access.
System -> Network -> Interface.
Using the Web-based manager:
Step by step:
- Go to System -> Network -> Interface.
- Select the Edit icon for the interface use for administrative access.
- In the Administrative Access section, select the SSH check box.
- Select 'OK'.
From CLI.
Enter show system interface<interface name>
and note the allowaccess setting, e.g.: ping https
Add ssh to the allowaccess setting:

# config system interface
edit <interface name>
set allowaccess ping https ssh
end

Use the SCP client
The FortiGate unit configuration file name is sys_config. Use the following syntax to download the file:
Linux.

scp admin@<FortiGate_IP>:sys_config <location>

Windows.

pscp admin@<FortiGate_IP>:sys_config <location>

When uploading (restoring) configuration file to FortiGate, destination file name is fgt-restore-config. Use the following syntax to upload the file:

Windows.

pscp.exe -scp <path_to_config_file> admin@<FortiGate_IP>:fgt-restore-config

The FortiGate firmware file name is firmware.out. Use the following syntax to upload the file:
Linux.

scp <firmware.out> <admin-user>@<IP>:fgt-image

Examples
These examples show how to download the configuration file from a FortiGate unit at IP address 172.20.120.171, using Linux and Windows SCP clients.
Linux client example:
To download the configuration file to a local directory called ~/config, enter the following command:

scp admin@172.20.120.171:sys_config ~/config

Enter the admin password when prompted.
Windows client example:
To download the configuration file to a local directory called c:config, enter the following command in a Command Prompt window:

pscp admin@172.20.120.171:sys_config c:config

Enter the admin password when prompted.
This example shows how to upload (restore) configuration file to a FortiGate unit with IP address 172.20.120.171, from Windows machine.

pscp.exe -scp C:Users<configuration file> admin@172.20.120.171:fgt-restore-config

Enter the admin password when prompted.
These examples show how to upload the firmware file from a FortiGate unit at IP address 172.20.120.171, using Linux SCP clients.
Linux client example:
To upload the firmware file to a local directory called firmware.out, enter the following command:

scp firmware.out admin@172.20.120.171:fgt-image

Enter the admin password when prompted.
Optional public-private key authentication
SCP authenticates itself to the FortiGate unit in the same way as an administrator using SSH to access the CLI. Instead of using a password, you can configure the SCP client and the FortiGate unit with a public-private key pair.
To configure public-private key authentication
Step by step:
- Create a public-private key pair using a key generator tool compatible with the SCP client.
- Save the private key to the location on the computer where the SSH private keys are stored.
This step depends on the SCP product. The SSH Secure Shell key generator automatically stores the private key. In the PuTTY Key Generator, you must manually save the private key.
- Copy the public key to the FortiGate unit. You do this in the FortiGate CLI, as follows:
- Enter

# config system admin
edit admin
set ssh-public-key1 '<key-type> <key-value>'
end

<key-type> must be ssh-dss for a DSA key or ssh-rsa for an RSA key. For <key-value>, you must copy the public key data and paste it into the CLI command.
If you are copying the key data from Windows Notepad, observe the following to copy the key data correctly:
- Copy one line at a time and make sure that the paste each line of key data at the end of the previously pasted data.
- Do not copy the end-of-line characters that appear as small rectangles in Notepad.
- Do not copy the ---- BEGIN SSH2 PUBLIC KEY ---- or Comment: '[2048-bit dsa,...]' lines.
- Do not copy the ---- END SSH2 PUBLIC KEY ---- line.
- Type the closing quotation mark and press Enter.
- Enter the end command.
The SCP client can now authenticate to the FortiGate unit based on SSH keys instead of an administrator password.