Shared traffic shaper

Shared traffic shaper is used in a firewall shaping policy to indicate the priority and guaranteed and maximum bandwidth for a specified type of traffic use.

The maximum bandwidth indicates the largest amount of traffic allowed when using the policy. You can set the maximum bandwidth to a value between 1 and 16776000 Kbps. The GUI displays an error if any value outside this range is used. If you want to allow unlimited bandwidth, use the CLI to enter a value of 0.

The guaranteed bandwidth ensures that there is a consistent reserved bandwidth available. When setting the guaranteed bandwidth, ensure that the value is significantly less than the interface's bandwidth capacity. Otherwise, the interface will allow very little or no other traffic to pass through, potentially causing unwanted latency.

In a shared traffic shaper, the administrator can prioritize certain traffic as high, medium, or low. FortiProxy provides bandwidth to low priority connections only when high priority connections do not need the bandwidth. For example, you should assign a high traffic priority to a policy for connecting a secure web server that needs to support e-commerce traffic. You should assign less important services a low priority.

When you configure a shared traffic shaper, you can apply bandwidth shaping per policy or for all policies. By default, a shared traffic shaper applies traffic shaping evenly to all policies that use the shared traffic shaper.

When configuring a per-policy traffic shaper, FortiProxy applies the traffic shaping rules defined for each security policy individually. For example, if a per-policy traffic shaper is configured with a maximum bandwidth of 1000 Kbps, any security policies that have that traffic shaper enabled get 1000 Kbps of bandwidth each.

If a traffic shaper for all policies is configured with a maximum bandwidth of 1000 Kbps, all policies share the 1000 Kbps on a first-come, first-served basis.

The configuration is as follows:

config firewall shaper traffic-shaper

edit "share1"

set guaranteed-bandwidth 15

set maximum-bandwidth 80000000

set bandwidth-unit gbps

set per-policy enable

set diffserv enable

set dscp-marking-method multi-stage

set exceed-bandwidth 16

set exceed-dscp 011111

set maximum-dscp 111111

set overhead 3

set diffservcode 000110

next

end

The shared traffic shaper selected in the traffic shaping policy affects traffic in the direction defined in the policy. For example, if the source port is LAN and the destination is WAN1, the traffic shaping affects the flow in this direction only, affecting the outbound traffic's upload speed. You can define the traffic shaper for the policy in the opposite direction (reverse shaper) to affect the inbound traffic's download speed. In this example, that would be from WAN1 to LAN.

Only traffic through forward traffic shapers will be included in FortiView; reverse and per-IP shapers are not included.

Traffic shapers can be added to a multicast policy when multicast routing is enabled.

The following example shows how to apply different speeds to different types of service. The example configures two shared traffic shapers to use in two firewall shaping policies. One policy guarantees a speed of 10 Mbps for VoIP traffic. The other policy guarantees a speed of 1 Mbps for other traffic. In the example, FortiProxy communicates with a PC using port10 and the Internet using port9.

To configure shared traffic shapers in the GUI:

1. Create a firewall policy:
   1. Go to Policy & Objects > Policy and click Create New.
   2. Set the Name to Internet Access.
   3. Set the Incoming Interface to port10.
   4. Set the Outgoing Interface to port9.
   5. Set the Source and Destination to all.
   6. Set the Schedule to always.
   7. Set the Service to ALL.
   8. Click OK.
2. Create the shared traffic shapers:
   1. Go to Policy & Objects > Traffic Shaping, select the Traffic Shapers tab, and click Create New.
   2. Set the Name to 10Mbps. This shaper is for VoIP traffic.
   3. Set the Traffic Priority to High.
   4. Enable Max Bandwidth and enter 20000.
   5. Enable Guaranteed Bandwidth and enter 10000.

      

   6. Click OK.
   7. Repeat the above steps to create another traffic shaper named 1Mbps with the Traffic Priority set to Low, the Max Bandwidth set to 10000, and the Guaranteed Bandwidth set to 1000.
3. Create a firewall shaping policy for VoIP traffic:
   1. Go to Policy & Objects > Traffic Shaping, select the Traffic Shaping Policies tab, and click Create New.
   2. Set the Name to VoIP_10Mbps_High.
   3. Set the Source and Destination to all.
   4. Set the Service to all VoIP services.
   5. Set the Outgoing Interface to port9.
   6. Enable Shared shaper and select 10Mbps.
   7. Enable Reverse shaper and select 10Mbps.
   8. Click OK.
4. Repeat the sub-steps in step 3 to create another firewall shaping policy named Other_1Mbps_Low for other traffic, with the Source and Destination set to all, Service set to ALL, Outgoing Interface set to port9, and Shared shaper and Reverse shaper set to 1Mbps.

To configure shared traffic shapers in the CLI:

1. Create a firewall policy:

   config firewall policy

   edit 1

   set name "Internet Access"

   set srcintf "port10"

   set dstintf "port9"

   set srcaddr "all"

   set dstaddr "all"

   set action accept

   set schedule "always"

   set service "ALL"

   set fsso disable

   set nat enable

   next

   end

2. Create the shared traffic shapers:

   config firewall shaper traffic-shaper

   edit "10Mbps"

   set guaranteed-bandwidth 10000

   set maximum-bandwidth 20000

   next

   edit "1Mbps"

   set guaranteed-bandwidth 1000

   set maximum-bandwidth 10000

   set priority low

   next

   end

3. Create a firewall shaping policy:

   config firewall shaping-policy

   edit 1

   set name "VOIP_10Mbps_High"

   set service "H323" "IRC" "MS-SQL" "MYSQL" "RTSP" "SCCP" "SIP" "SIP-MSNmessenger"

   set dstintf "port9"

   set traffic-shaper "10Mbps"

   set traffic-shaper-reverse "10Mbps"

   set srcaddr "all"

   set dstaddr "all"

   next

   edit 2

   set name "Other_1Mbps_Low"

   set service "ALL"

   set dstintf "port9"

   set traffic-shaper "1Mbps"

   set traffic-shaper-reverse "1Mbps"

   set srcaddr "all"

   set dstaddr "all"

   next

   end

To check the statuses of shared traffic shapers:

# diagnose firewall shaper traffic-shaper list

name 10Mbps

maximum-bandwidth 2500 KB/sec

guaranteed-bandwidth 1250 KB/sec

current-bandwidth 0 B/sec

priority 2

tos ff

packets dropped 0

bytes dropped 0

name 1Mbps

maximum-bandwidth 1250 KB/sec

guaranteed-bandwidth 125 KB/sec

current-bandwidth 0 B/sec

priority 4

tos ff

packets dropped 0

bytes dropped 0