Technical Tip: Important Changes to Traffic Shaping on FortiGate with NP7 Queuing-Based Traffic Management (QTM) Module

1. The QTM module on NP7 will not be used for policy shaping, per-ip shaping, and regular interface shaping i.e., configuring 'set outbandwidth' settings on an interface without a shaping profile. Instead, a Traffic Policing Engine (TPE) will be used.
2. The following configuration will not support an option to configure queuing-based shaping.

config system npu
    set default-qos-type {policing | shaping} <----- From previous firmware.
    set default-qos-type {policing} <----- On new firmware, shaping option is removed.
end

3. Despite the default QoS type always set to policing, the QTM module on NP7 will still be utilized when a shaping profile is configured on the interfaces. These interfaces may include physical interfaces, IPSec interfaces, LAG interfaces, or VLAN interfaces over physical or LAG types.

config system interface
    edit <interface>
    ....
        set egress-shaping-profile "Day_Hours_Profile"
        set outbandwidth 10000
    ....
    next
end

A maximum of 672 shaping profiles can be active at any given time on any NP7 platform FortiGate device. This limit also applies to the child tunnels of a Dialup IPsec tunnel when a shaping profile is applied to the Dial-Up Tunnel Interface.

4. When configuring a shaping profile, the interface MTU cannot exceed 6000 bytes. If the interface MTU is greater than 6000 bytes, the interface will not accept a shaping profile.
5. This change has been introduced due to NP7 hardware limitations and does not apply to NP7 Lite (SOC5) processors. So, for FortiGates with NP7Lite processors, it is still possible to select the module the NP7Lite processor uses for traffic shaping.

The changes described above have been implemented in v7.2.11, v7.4.8, and v7.6.1.