When using Debugging the packet flow to debug the packet flow and 'iprope' command is used:
diagnose debug flow show iprope enable
diagnose debug flow show function enable
While shaping policies are configured on FortiGate, debug output will show a match on iprope list 100015. In the example below, the match is on the iprope list policy '25'.
On the FortiGate CLI, the output of iprope list 100015 shows the configured shaping policies:
FGT40F-Spoke # diagnose firewall iprope list 100015
policy index=20 uuid_idx=1798 action=accept
flag (0):
schedule()
cos_fwd=255 cos_rev=255
group=00100015 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0
zone(1): 0 -> zone(1): 0
source(4): 10.10.10.0-10.255.255.255, uuid_idx=1555
dest(1): 192.168.4.0-192.168.4.255, uuid_idx=968,
service(1):
[6:0x0:0/(1,65535)->(80,80)] flags:0 helper:auto
class_id: 5
...
policy index=25 uuid_idx=1815 action=accept
flag (0):
schedule()
cos_fwd=255 cos_rev=255
group=00100015 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0
zone(1): 0 -> zone(1): 0
source(1): 0.0.0.0-255.255.255.255, uuid_idx=548,
dest(1): 0.0.0.0-255.255.255.255, uuid_idx=548,
service(1):
[0:0x0:0/(0,65535)->(0,65535)] flags:0 helper:auto
class_id: 2
On the FortiGate configuration, this information can be reviewed:
config firewall shaping-policy
edit 20
set service "HTTP"
set dstintf "any"
set class-id 5
set srcaddr "Net_10.10.10.0/24"
set dstaddr "Network_192.168.4.0"
next
edit 25
set name "Default"
set service "ALL"
set dstintf "any"
set class-id 2
set srcaddr "all"
set dstaddr "all"
next
end
| 
