Best practices for traffic shaping?

[billp]

OK. Read the posts. Read the docs. Traffic shaping seems to be more art than science. I was hoping that those who have successfully shaped their traffic could help fill in the gaps. I' m interested in traffic shaping all sites for certain groups of users so that the group can never use, say, more than 5mbps for all traffic. This is tricky because the users need a Protection Profile. And, also interested in traffic shaping sites like Itunes for all users, which seems simple since no Protection Profile is needed for this. Can anyone comment on the issues below? 1. Docs say that for traffic shaping to work well, total bandwidth available must be assigned to outgoing WAN interface via CLI. Anyone doing this? 2. Posts on the forums say that traffic shaping does not work properly if assigned to policies that have Protection Profiles associated with them? Can anyone add more specifics of what happens? This really limits effective shaping if this is true. 3. Seems like the most reliable way to traffic shape is to create policies based on individual IP addresses and then apply a shaper policy. Is this what most people are doing to limit Youtube, Itunes, etc.? Have not had a lot of luck using FQDN to limit traffic. 4. For best results, docs say that all traffic policies must be shaped with low, medium, high priorities. Everyone doing this? Any other best practices suggestions? Thanks for help/suggestions.

[emnoc]

I' m shaping but primarily only for voip traffic. We also have a single shared uplink, so I have bandwidth allocation for interface XYZ customer XYZ. I' m also getting ready to rate limit some VPN site2site that interfaces customer at remote locations. They pull data from a DBserver during the day and we want them to be restricted in bandwidth size But I agreed that traffic shaping is a art. What we ended up doing for one customer, where HTTP downloads was killing them, we used our cisco routers that terminate the internet pipe and provide strict policing for HTTP content type. Just something to think about. Today, no firewall that I' m aware of will allow for that grainularity of rate limit based on MIME types. A few tips of advice from what I experienced, draw out your plan and FWpolicy map ensure your FW policies are specific for those that shapes FWpolicies order placement is crucial, make sure no any any comes before a shaped policy Good luck

[billp]

Thanks for the advice. For now, I am just going after the big fish. I am using the FortiAnalyzer to see what sites have the heaviest traffic, and will then traffic shape those sites by IP. After that, I' m considering a rate limit for specific users that tend to abuse the system. Any idea how Protection Profiles affect/ruin traffic shaping? That' s key for me, as it would allow me to shape a particular group of users instead of individual sites. Thanks again.

[romanr]

Any idea how Protection Profiles affect/ruin traffic shaping?

What I have seen it seems that he virus scanner does not to work porperly with the traffic shaper! If there is a download of a file the virus scanning proxy will fetch the file at full speed until its configured file size limit.... Maybe this got better with 4.1, but I haven' t done serious testing by now! cheers.roman

[emnoc]

I' m doing my VoIP shaping at the fwpolicy level with the latest fortiOS 4.X. I' ve also " set inband" limits on my dedicate link servicing another floor and group of users, so this would be ingress policy. ( they are limit to just 5megs in my case ) How shaping and it' s dependencies on a PP, I have no ideals on how that works or any concerns in that area. So you need to really look at you gurantee and max levels and draft out a plan on how your going todo it. I dump all of my policies list the ones that need shaping/policers allowed and build up the numbers and design. They deploy and monitor both flows and feedback.

[laf]

Hi, From what I know, I doubt there is anything such as best practice for Fortigate' s traffic shaping. It basically does not WORK on v3.0 any MR number. I ve worked on this for about two weeks! I needed to set up a guaranteed 2Mbps bandwidth for one IPSEC tunnel. Made some plans for each firewall policy as once you enabled it for one policy you will need to set up for all in that traffic direction. If you don' t all the traffic will be placed in the HIGH priority queue. Or at least this it what Fortinet pretends. There was no luck. I mean Fortigate can' t guarantee anything. The only functional feature is traffic rate limit, but no guarantee. The doc they provide is useless as it' s only hypothetical. And Fortinet' s ticketing support :)? I can paste you guys the whole ticket: nothing than copy paste from that useless doc. No thinking from them, just paste like monkeys :(. In conclusion I suggest you guys to wait for MR2 maybe will be better, or quit thinking about Fortigate and guaranteed bandwidth.

[rwpatterson]

One thing I noticed is the default level is high for all traffic. From the CLI, change that to ' medium' so that high has some real meaning.

 config system global
     set tos-based-priority medium
 

[billp]

Thanks to all for the ongoing suggestions. Bob -- great idea on the CLI config. I' ll give that a shot.