Skip to main content
A
Anonymous_User
Contributor
July 27, 2010
Question

Reverse Traffic Shaping

  • July 27, 2010
  • 5 replies
  • 7069 views
I' am traying to traffic shape the systems in my LAN. The external connection is DSL with 16 Mbit/s ingress and 1 MBit/s egress traffic. I want to assign to each system a minimum of 1 MBit/sec ingress & 128 kBit/sec egress traffic. Packets should be dropped if one system uses more than 8 Mbit/sec ingress & 768 kBit/sec egress. Thus I configured following two traffic shapers: config firewall shaper traffic-shaper edit " Down_8M-max_1M-min" set guaranteed-bandwidth 128 set maximum-bandwidth 1024 set per-policy enable next edit " Up_768k-max_128k_min" set guaranteed-bandwidth 16 set maximum-bandwidth 96 set per-policy enable next end And for each system I have configured a firewall policy (example below is for system " Pe-Lt-2-w" ): config firewall policy edit 10 set srcintf " internal" set dstintf " wan1" set srcaddr " Pe-Lt-2-w" set dstaddr " all" set action accept set utm-status enable set schedule " always" set service " ANY" set av-profile " scan" set webfilter-profile " scan" set spamfilter-profile " scan" set ips-sensor " protect_client" set application-list " Application-control" set voip-profile " voip_1" set profile-protocol-options " scan" set traffic-shaper " Down_8M-max_1M-min" set traffic-shaper-reverse " Up_768k-max_128k_min" set nat enable next When testing the traffic shapers the ingress traffic will be limited to 8 MBit/sec as specified. However the egress traffic will not be shaped - I still can upload files with the full data rate of 1 MBit/sec for the DSL. I' am using FortiGate 80C with V4.0, MR 2 Patch 1 (build 0279) release. Can someone please enlighten me if I did something wrong. Or is this a bug in the release that should be reported to Fortinet support. Regards, ... Peter

    5 replies

    quadrozep
    quadrozep
    New Member
    July 29, 2010
    I' m working on something very similar, were you able to get this figured out? My thought was that you would need another policy (WAN->Int) and apply another traffic shaper for the upload traffic.
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 29, 2010
    Hi, have you set the correct interface bandwidth? AFAIU this is the physical bw of the NIC: conf sys int ed wan1 set inbandwidth <integer> in KB/s (0-2097000; 0 for unlimited) set outbandwidth <integer> in KB/s (0-2097000; 0 for unlimited) next end The algorithm needs these figures to correctly calculate the packet drop rate. source: Release Notes and KC (search for " outbandwidth" :( [link=]http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30162&sliceId=1&docTypeID=DT_KCARTICLE_1_1[/link]
    A
    Anonymous_UserAuthor
    Contributor
    July 29, 2010
    Hi, I have set " inbandwidth" & " outbandwidth" on my Internet interface " wan1" as you recommended. No change in overall behavior at all. But then I played around with the options " set traffic-shaper" and " set traffic-shaper-reverse" I found out that you have to apply the 8M-max/1M-min rule to the " reserve traffic shaper" and the 768k-max/128k-min rule to the " traffic shaper" . This is odd since the documentation implies the reverse behavior. I did some tests with my " internal->wan1" firewall policy and it looks I have achieved what I wanted to do: a) limit download traffic (e.h. http client from internal loading a file from web server in the Internet) to 8 MBit/sec b) limit upload traffic (e.g. ftp client from internal storing a file to a ftp server in the Internet) to 768 kbps/sec Unfortunately I have to duplicate all firewall policies for the clients in my " internal" network. I will do some more testing letting multiple clients download / upload files in parallel through the the traffic shapers. But for the moment it looks like my problem has been solved. Regards, ... Peter
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 29, 2010
    This is the expected behaviour. For explanations, see my today' s post in the Firewall forum titled " Traffic Shaping question" .
    A
    Anonymous_UserAuthor
    Contributor
    November 18, 2010
    Hi guys! I' m having problems with bandwidth guarantees. Maximum bandwidth works, but guarantees not. =/ Note: Even I have nothing configured about " conf sys int" Maximum bandwidth works. But, first I think that is better if I try to understand some concepts. Some questions that I should be clear: 1 - In instance, if I have a firewall policy from LAN to WAN, Traffic Shapping option controls Upload from an internal PC to WAN and Reverse Direction Traffic Shapping controls Download from WAN to an internal PC. Is it right? 2 - I read the Technical Note, but some things was not clear for me. For example, if I want controlling (guarantee) my Download rate so must I configure outbandwitdth for my WAN? I think that I need configuring outbandwidth for LAN interface , right? Follows bellow my confs: Fortigate200B (traffic-shaper) # show config firewall shaper traffic-shaper edit " low-priority" set maximum-bandwidth 768 set per-policy enable set priority low next edit " WTS" set guaranteed-bandwidth 690 set maximum-bandwidth 768 set per-policy enable next edit " low-priority-up" set maximum-bandwidth 128 set per-policy enable set priority low next edit " WTS-up" set guaranteed-bandwidth 104 set maximum-bandwidth 128 set per-policy enable next end Fortigate200B (policy) # show config firewall policy edit 2 set srcintf " WAN" set dstintf " switch" set srcaddr " all" set dstaddr " DNS ipTrust" set action accept set schedule " always" set service " DNS" next edit 4 set srcintf " switch" set dstintf " WAN" set srcaddr " WTS" set dstaddr " Download Virtua" set action accept set schedule " always" set service " ANY" set traffic-shaper " WTS-up" set traffic-shaper-reverse " WTS" set nat enable next edit 3 set srcintf " switch" set dstintf " WAN" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ANY" set traffic-shaper " low-priority-up" set traffic-shaper-reverse " low-priority" set nat enable next end Did I do Something wrong? Let me know if I was not so clear, but I' m already confused with this situation. I already read the Handbook , too. Thanks guys!!
    Terms & ConditionsAccessibility statement