Technical Tip: How to apply Shared traffic shaper and Per-IP traffic shaper in a firewall policy

Description

This article explains how to apply Shared traffic shaper and Per-IP shaping directly within a firewall policy using the CLI. 

Scope

FortiGate.

In FortiOS v5.2, traffic shaping was configured over the firewall policy. By default, if the intention was to apply traffic shaping, it was only necessary to create a shaper and direct it to a firewall policy.

In FortiOS v5.6 and above, there is no option to create a shaper for a firewall policy in the GUI. This can only be done through the CLI.

Solution

Traffic shaping in a firewall policy needs to be configured using the CLI. There is currently no method to enable traffic shaping in the GUI. After adding, it will be possible to modify the policy in the GUI.

If traffic shaping is removed through the GUI and the firewall policy has been saved, it will be necessary to use the CLI to create it again.

This command applies to the traffic from ingress to egress direction, meaning it will affect the upload speeds and outbound traffic:

set traffic-shaper <shaper>

This command applies to the traffic from egress to ingress direction, meaning it will affect the download speeds and the inbound traffic:

set traffic-shaper-reverse <shaper>

This command applies a Per-IP shaper, which limits bandwidth on a per-source IP basis:

set per-ip-shaper <shaper> 

Follow the steps below to create traffic shaping in a firewall policy:

Go to Policy & Objects -> IPv4 Policy, 'right-click' the policy for which traffic shaping will be configured, and select 'Edit in CLI'.

Configure the following inside the policy through the CLI, applying the shared traffic shaper in a Firewall Policy:

config firewall policy  
    edit <fw_policy_id>     
        set traffic-shaper <shaper name>
        set traffic-shaper-reverse <shaper name>
end

 
Applying a per-IP traffic shaper in a Firewall Policy:

set per-ip-shaper <shaper name>

Alternatively, go directly from the CLI to the specific firewall policy and enable per-IP shaping:

config firewall policy
    edit <fw_policy_id>
        set per-ip-shaper <shaper name>
    end
end

Once configured, the traffic shaping configuration will be visible under the policy section in the GUI:

These steps must be completed for every individual policy to which shaping will be applied.

Note: To verify Traffic Shaper status through the CLI, use the following commands:

diagnose sys session filter src <SRC-IP>
diagnose sys session filter dst <DST-IP>
diagnose sys session list

The output will show details about shaper applied and traffic dropped due to the shaper.

Note:

Traffic shaping profile cannot be applied to explicit proxy policy, configuring traffic shaping for explicit proxy can be done by explicit proxy listing interface level, refer to: Configure traffic shaping for explicit proxy.

Related documents:

• Technical Tip: How to configure and check which traffic shaper is used

• Technical Tip: Monitoring 'Traffic Shaping'

• Technical Tip: Application control based traffic shaper

• Traffic shaping policies