Technical Tip: How to configure Per-IP traffic shaper on FortiGate

To create a per-ip shaper via GUI on FortiOS 7.6.x version, the option to create a per-ip shaper is on the top-right, as per the screenshot below. The user can switch between Shared/Per-IP to configure as per requirements.

The per-IP traffic shaper is used to limit the bandwidth of each user/IP address.
If the ISP bandwidth is 100 Mbps, a 10 Mbps shaper is allocated per user using a per-IP shaper as shown in the example below. If there are ten users, each user will get 10 Mbps of bandwidth, resulting in complete usage of 100 Mbps.
The per-IP shaper ensures that each user/IP address receives its own dedicated bandwidth.

Configure in CLI:

config firewall shaper per-ip-shaper
    edit "CaptNaveen"
        set max-bandwidth 10000
    next
end

config firewall shaping-policy
    edit 3
        set uuid 06244f12-7f49-51f0-4cb4-47e5f88ce515
        set name "Per_IP"
        set service "ALL"
        set srcintf "port2"
        set dstintf "port1"
        set per-ip-shaper "CaptNaveen"
        set srcaddr "all"
        set dstaddr "all"
    next
end

Useful commands:

Note: Make sure there is no device performing SNAT in between; in such cases, all traffic will be coming with a single NAT IP towards FortiGate.

In such cases, the Per-IP shaper can not be used.

diagnose firewall iprope list
diagnose firewall shaper per-ip-shaper list

diagnose sys session filter src <addr>
diagnose sys session filter dst <addr>
diagnose sys session list

Related document:

Traffic shapers