Local-in and local-out traffic matching

A FortiGate can apply shaping policies to local traffic entering or leaving the firewall interface based on source and destination IP addresses, ports, protocols, and applications.

config firewall shaping-policy
    edit <id>
        set traffic-type {forwarding | local-in | local-out}
    next
end

This topic contains the following examples:

• Example 1: local-in traffic shaping
• Example 2: local-out traffic shaping

Example 1: local-in traffic shaping

In this example, the traffic shaping policy applies to local-in traffic. The local-in traffic originates from the Linux client and is destined to port1 on the FortiGate.

To configure the traffic shaping policy:

config firewall shaping-policy
    edit 2
        set traffic-type local-in
        set service "ALL"
        set schedule "always"
        set class-id 3
        set srcaddr "all"
        set dstaddr "all"
    next
end

To verify the configuration:

1. Check the shaping policy information for local-in traffic to verify that the correct class ID (3) is applied:

   # diagnose firewall iprope list 100018
   policy index=2 uuid_idx=1300 action=accept
   flag (0): 
   schedule(always)
   cos_fwd=0  cos_rev=0 
   group=00100018 av=00000000 au=00000000 split=00000000
   host=1 chk_client_info=0x0 app_list=0 ips_view=0
   misc=0
   zone(1): 0 -> zone(1): 0 
   source(1): 0.0.0.0-255.255.255.255, uuid_idx=1106, 
   dest(1): 0.0.0.0-255.255.255.255, uuid_idx=1106, 
   service(1): 
           [0:0x0:0/(0,65535)->(0,65535)] flags:0 helper:auto  
   class_id: 3

2. Check the session list to verify that the class ID (3) matches the shaping policy ID (2):

   # diagnose sys session list 
   session info: proto=6 proto_state=01 duration=1195 expire=3574 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=3 shaping_policy_id=2 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/0
   state=log local may_dirty 
   statistic(bytes/packets/allow_err): org=18274/350/1 reply=826037/603/1 tuples=2
   tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 1/0
   orgin->sink: org pre->in, reply out->post dev=17->34/34->17 gwy=172.16.200.2/0.0.0.0
   hook=pre dir=org act=noop 172.16.200.254:55432->172.16.200.2:443(0.0.0.0:0)
   hook=post dir=reply act=noop 172.16.200.2:443->172.16.200.254:55432(0.0.0.0:0)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=08:5b:0e:7d:42:db
   misc=0 policy_id=4294967295 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=1
   serial=0000009d tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=00000000
   no_ofld_reason:  local

Example 2: local-out traffic shaping

In this example, the traffic shaping policy applies to local-out traffic. The local-out traffic originates from port2 on the FortiGate and is destined to an external web server.

To configure the traffic shaping policy:

 config firewall shaping-policy
    edit 3
        set traffic-type local-out
        set service "ALL"
        set schedule "always"
        set class-id 2
        set srcaddr "all"
        set dstaddr "all"
    next
end

To verify the configuration:

1. Check the shaping policy information for local-out traffic to verify that the correct class ID (2) is applied:

   # diagnose firewall iprope list 100019
   policy index=3 uuid_idx=1301 action=accept
   flag (0): 
   schedule(always)
   cos_fwd=0  cos_rev=0 
   group=00100019 av=00000000 au=00000000 split=00000000
   host=1 chk_client_info=0x0 app_list=0 ips_view=0
   misc=0
   zone(1): 0 -> zone(1): 0 
   source(1): 0.0.0.0-255.255.255.255, uuid_idx=1106, 
   dest(1): 0.0.0.0-255.255.255.255, uuid_idx=1106, 
   service(1): 
           [0:0x0:0/(0,65535)->(0,65535)] flags:0 helper:auto  
   class_id: 2

2. Check the session list to verify that the class ID (2) matches the shaping policy ID (3):

   # diagnose sys session list
   session info: proto=6 proto_state=05 duration=40 expire=110 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=2 shaping_policy_id=3 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
   state=log local 
   statistic(bytes/packets/allow_err): org=3676/14/1 reply=3848/11/1 tuples=2
   tx speed(Bps/kbps): 90/0 rx speed(Bps/kbps): 94/0
   orgin->sink: org out->post, reply pre->in dev=34->17/17->34 gwy=0.0.0.0/172.16.200.2
   hook=out dir=org act=noop 172.16.200.2:19178->140.174.22.68:443(0.0.0.0:0)
   hook=in dir=reply act=noop 140.174.22.68:443->172.16.200.2:19178(0.0.0.0:0)
   pos/(before,after) 0/(0,0), 0/(0,0)
   dst_mac=08:5b:0e:7d:42:db
   misc=0 policy_id=0 pol_uuid_idx=0 auth_info=0 chk_client_info=0 vd=1
   serial=00000f1b tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=00000000
   no_ofld_reason:  local