Technical Tip: How to configure Per-IP traffic shaper on FortiGate

[knaveenkumar]

Description	This article explains how to configure the Per-IP traffic shaper.
Scope	FortiGate v7.4 and v7.6.
Solution	To create a per-ip shaper via GUI on FortiOS 7.6.x version, the option to create a per-ip shaper is on the top-right, as per the screenshot below. The user can switch between Shared/Per-IP to configure as per requirements. The per-IP traffic shaper is used to limit the bandwidth of each user/IP address. If the ISP bandwidth is 100 Mbps, a 10 Mbps shaper is allocated per user using a per-IP shaper as shown in the example below. If there are ten users, each user will get 10 Mbps of bandwidth, resulting in complete usage of 100 Mbps. The per-IP shaper ensures that each user/IP address receives its own dedicated bandwidth. Configure in CLI: config firewall shaper per-ip-shaper     edit "CaptNaveen"         set max-bandwidth 10000     next end config firewall shaping-policy     edit 3         set uuid 06244f12-7f49-51f0-4cb4-47e5f88ce515         set name "Per_IP"         set service "ALL"         set srcintf "port2"         set dstintf "port1"         set per-ip-shaper "CaptNaveen"         set srcaddr "all"         set dstaddr "all"     next end Useful commands: Note: Make sure there is no device performing SNAT in between; in such cases, all traffic will be coming with a single NAT IP towards FortiGate. In such cases, the Per-IP shaper can not be used. diagnose firewall iprope list diagnose firewall shaper per-ip-shaper list diagnose sys session filter src <addr> diagnose sys session filter dst <addr> diagnose sys session list Related document: Traffic shapers