NP7 and NP7Lite (SOC5) traffic shaping

NP7 and NP7Lite (SOC5) processors support offloading for all FortiOS traffic shaping functions, including:

Policy traffic shaping, see Traffic shaping policies.
Per-ip shaping, see Per-IP traffic shaper.
Regular Port shaping (inbandwidth/outbandwidth), see Configuring the interface outbandwidth.
Traffic shaping profiles applied to interfaces or IPsec VPN tunnels, see Interface-based traffic shaping profile.

By default, all NP7 or NP7Lite traffic shaping is applied to all offloaded traffic with traffic shaping configured. No special NP7 or NP7Lite configuration is required to to support traffic shaping for offloaded traffic. In any traffic shaping configuration, you can choose to disable offloading. When offloading is disabled, traffic shaping is applied by the CPU.

NP7 and NP7Lite (SOC5) processors include two traffic shaping modules:

The accounting and traffic shaping module (called the TPE module), applies traffic shaping using policing. Policing drops packets when traffic exceeds configured bandwidth limits.
The queuing based Traffic Management (QTM) module, applies queuing for traffic shaping. Queuing puts packets into queues when traffic exceeds the configured bandwidth limits, releasing packets from the queues as traffic bandwidth reduces. Queuing may drop packets if the queues are full.

NP7 Lite (SOC5) processors and traffic shaping

Ideally, you should be able to select the NP7 or NP7Lite traffic shaping module to use, depending on whether you want the NP7 processor to perform queuing or policing. In fact this choice is supported by FortiGates with NP7Lite processors.

For FortiGates with NP7Lite processors, you can use the following command to select the module that the NP7Lite processor uses to apply traffic shaping:

config system npu

set default-qos-type {policing | shaping}

end

The default setting is shaping, and the NP7Lite processor uses the QTM module to apply traffic shaping. If you change this option to policing, the NP7Lite processor uses policing using the TPE module to apply traffic shaping. One exception to this is that, for traffic shaping profiles applied to interfaces or IPsec VPN tunnels, even if the default-qos-type is shaping, NP7Lite processors apply traffic shaping using queuing with the QTM module.

Traffic shaping type	NP7Lite (SOC5) traffic shaping module
Policy traffic shaping Per-IP shaping Regular port shaping (inbandwidth/outbandwidth)	The `default-qos-type` can be set to `shaping` (the default) or changed to `policing`.
Traffic shaping profiles applied to interfaces or IPsec VPN tunnels	Queuing using the QTM module.

NP7 processors and traffic shaping

Due to NP7 hardware limitations, you can't change the default-qos-type for NP7 processors. Instead, default-qos-type is always set to policing and the NP7 processor selects the optimal traffic shaping module to use, based on internal and customer testing results. See the following table for details:

Traffic shaping type	NP7 traffic shaping module
Policy traffic shaping Per-IP shaping Regular port shaping (inbandwidth/outbandwidth)	Policing using the TPE module.
Traffic shaping profiles applied to interfaces or IPsec VPN tunnels	Queuing using the QTM module.

NP7 and NP7Lite traffic shaping limitations

Under most traffic conditions, the TPE module max shaper limit is 8Gbps. The TPE module can't reliably apply traffic shaping to higher bandwidth traffic flows.
Under most traffic conditions, the QTM module max shaper limit is 10Gbps. per interface. The QTM module can't reliably apply traffic shaping to higher bandwidth traffic flows.
Policy traffic shaping, per-IP shaping, and regular port shaping (outbandwidth enabled on an interface without a shaping profile) always applies traffic shaping using policing with the TPE module.
Traffic shaping profiles applied to interfaces or IPsec VPN tunnels always applies traffic shaping using queuing with the QTM module. The interface can be a physical interface, LAG interface, and VLAN interface (over physical or LAG). Traffic shaping profiles applied to interfaces or IPsec VPN tunnels is also called Multiclass shaping (MCS).
Traffic shaping profiles applied to interfaces or IPsec VPN tunnels can support a maximum of 100 interfaces. When the QTM model exceeds 100 interfaces, shaper offloading fails and traffic won’t be offloaded or shaping will not work.
In may cases, the 100-interface limit may not be a problem. However, dialup IPsec VPN can create a large amount of interfaces, so in most cases NP7 offloading for dialup IPsec VPN configurations with traffic shaping may not work as expected.
The QTM module supports packets with an MTU value of 6000 or less. You should check your confirmation to make sure all interfaces in the path of traffic shaping profiles applied to interfaces or IPsec VPN tunnels are set to an MTU value of 6000 or less.
NP7 and NP7Lite processors do not support setting a priority in a traffic shaping profile. The priority option is ignored by NP7 and NP7Lite processors. Otherwise, once the guaranteed bandwidth is satisfied, traffic shaping works as expected for NP7 or NP7Lite-offloaded sessions.

The priority setting does apply to software sessions on FortiGates with NP7 or NP7Lite processors.