Fortinet Document Library

Version:


Table of Contents

New Features

6.4.0
Download PDF
Copy Link

Interface-based traffic shaping with NP acceleration

Interface-based traffic shaping with NP acceleration is supported on some devices.

An administrator configures the WAN interface's maximum outbound bandwidth and, based on that, creates a traffic shaping profile with a percentage based shaper. This allows for proper QoS and traffic shaping. VLAN interfaces are not supported.

This feature is supported on FortiGate 600E, 500E, and 300E models.

To configure interface-based traffic shaping:
  1. Enable NPU offloading when doing interface-based traffic shaping according to the egress-shaping-profile:
    config system npu
        set intf-shaping-offload enable
    end
  2. Configure shaping profiles:
    config firewall shaping-profile
        edit "sdwan"
            set default-class-id 4
            config shaping-entries
                edit 1
                    set class-id 4
                    set guaranteed-bandwidth-percentage 3
                    set maximum-bandwidth-percentage 5
                next
                edit 2
                    set class-id 3
                    set priority medium
                    set guaranteed-bandwidth-percentage 50
                    set maximum-bandwidth-percentage 100
                next
                edit 3
                    set class-id 2
                    set priority low
                    set guaranteed-bandwidth-percentage 1
                    set maximum-bandwidth-percentage 5
                next
            end
        next
    end

    The class number is limited to 16.

  3. Configure a traffic shaper and shaping policy:
    config firewall shaper traffic-shaper
        edit "Transactional"
            set priority medium
        next
    end
    
    config firewall shaping-policy
        edit 1
            set service "ALL"
            set dstintf "any"
            set traffic-shaper "Transactional"
            set class-id 3
            set srcaddr "all"
            set dstaddr "all"
        next
    end
  4. Apply the egress shaping profile on the interface:
    config system interface
        edit "port2"
            set vdom "root"
            set ip 10.1.100.23 255.255.255.0
            set allowaccess ping
            set type physical
            set outbandwidth 500
            set egress-shaping-profile "sdwan"
            set snmp-index 4
        next
    end
  5. Configure a firewall policy:
    config firewall policy
        edit 3
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set logtraffic all
            set nat enable
        next
    end

Interface-based traffic shaping with NP acceleration

Interface-based traffic shaping with NP acceleration is supported on some devices.

An administrator configures the WAN interface's maximum outbound bandwidth and, based on that, creates a traffic shaping profile with a percentage based shaper. This allows for proper QoS and traffic shaping. VLAN interfaces are not supported.

This feature is supported on FortiGate 600E, 500E, and 300E models.

To configure interface-based traffic shaping:
  1. Enable NPU offloading when doing interface-based traffic shaping according to the egress-shaping-profile:
    config system npu
        set intf-shaping-offload enable
    end
  2. Configure shaping profiles:
    config firewall shaping-profile
        edit "sdwan"
            set default-class-id 4
            config shaping-entries
                edit 1
                    set class-id 4
                    set guaranteed-bandwidth-percentage 3
                    set maximum-bandwidth-percentage 5
                next
                edit 2
                    set class-id 3
                    set priority medium
                    set guaranteed-bandwidth-percentage 50
                    set maximum-bandwidth-percentage 100
                next
                edit 3
                    set class-id 2
                    set priority low
                    set guaranteed-bandwidth-percentage 1
                    set maximum-bandwidth-percentage 5
                next
            end
        next
    end

    The class number is limited to 16.

  3. Configure a traffic shaper and shaping policy:
    config firewall shaper traffic-shaper
        edit "Transactional"
            set priority medium
        next
    end
    
    config firewall shaping-policy
        edit 1
            set service "ALL"
            set dstintf "any"
            set traffic-shaper "Transactional"
            set class-id 3
            set srcaddr "all"
            set dstaddr "all"
        next
    end
  4. Apply the egress shaping profile on the interface:
    config system interface
        edit "port2"
            set vdom "root"
            set ip 10.1.100.23 255.255.255.0
            set allowaccess ping
            set type physical
            set outbandwidth 500
            set egress-shaping-profile "sdwan"
            set snmp-index 4
        next
    end
  5. Configure a firewall policy:
    config firewall policy
        edit 3
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set logtraffic all
            set nat enable
        next
    end