FortiGate Shaping Profile VPN interface

Question

Hi All,

I'm implementing SDWAN topology with Dial-Up Ipsec VPNs. I also want to implement traffic shaping for the relevant traffic. I plan to use Shaping profiles on interfaces but I'm a little bit confused about where to put the shaping profile. On the VPN interface, or on the physical WAN interface. Or Both? Never find a documentation about that.

Thank you!

Dhruvin_patel · Accepted Answer

Greetings!

To implement traffic shaping for your SD-WAN topology with dial-up IPsec VPNs, you can apply shaping profiles on the VPN interface or the physical WAN interface, depending on your specific requirements. Here's a general guideline to help you decide:

1. VPN Interface:
- Apply shaping profiles on the VPN interface if you want to shape traffic specifically for the VPN tunnels.
- This allows you to control the traffic shaping policies for individual VPN tunnels based on their characteristics.

2. Physical WAN Interface:
- Apply shaping profiles on the physical WAN interface if you want to shape traffic before it enters the VPN tunnels.
- This can help in managing overall bandwidth allocation and shaping traffic before it is encapsulated in the VPN tunnels.

3. Both Interfaces:
- You can apply shaping profiles on both the VPN interface and the physical WAN interface for a more granular control over traffic shaping.
- This approach allows you to shape traffic at different stages of the network flow, providing a comprehensive traffic management solution.

Consider your network design, traffic patterns, and shaping requirements to determine whether to apply shaping profiles on the VPN interface, physical WAN interface, or both. It's essential to test and monitor the impact of your traffic shaping configurations to ensure they meet your network performance goals effectively.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Outbound-Traffic-Shaping-for-IPSec/ta-p/324454

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/979367/interface-based-qos-on-individual-child-tunnels-based-on-speed-test-results

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/647914/interface-based-traffic-shaping-profile

Regards!

justink84 · Answer

Just wanted to add some info here. I wanted the interface shaper that was used for my sd-wan tunnels and physical interface to be the same. This way its a single source of truth and a single location where its applied.

I have found if you disable asic on policies going to/from ipsec. The applications will be honored on the physical interface for your ingress/egress shaping-profile.

Yes you will take a hit by traffic hitting your main cpu vs asic offloaded. I think there is some limitations to how everything happens. The problem I ran into is. If I want to say my wan1 interface is 100/100 I dont care if its vpn or internet traffic. I want it to be treated the same. I dont want to carve out 50 mb for internet and the other 50 for vpn. I also want to be able to prioritize an app that may be encrypted via ipsec if internet is utilized.

Its nice you can create many different shappers and apply to each interface. In the end I just wanted a single shaper on wan1 and single shaper on wan2. What I thought would be a straight forward task was a bit harder to complete.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded