FortiOS 7.4 and traffic shaping wan to lan

[it-andreagx]

Hello, 

I need to limit the the bandwith at 100kps from a designed Public IP address (WAN) to an internal host. 

Where is the best way to do this? We have to consider reserse traffic?

This is my Traffic Sharing Policy. All advice welcome.

[srajapratap]

Hello @it-andreagx ,

I believe the configuration looks fine, but make sure that the destination address in the traffic shaping policy is the VIP object which can perform DNAT for the ingress traffic from the internet to the internal server. To confirm, if the traffic shaping is actually taking place, check the sessions created for this specific flow of traffic and look for keyword 'origin-shaper'. Below documentation can help out.

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/933502/shared-traffic-shaper

Regards,

[it-andreagx]

Hello @srajapratap, 

It seems that you cannot select any VIPs in the Destination field.

[AEK]

Hi

Try read and understand well about traffic shaping and reverse shaping.

Personally I never shape the traffic incoming from WAN, because as per my understanding it can have bad effect on the WAN bandwidth. Instead, I prefer shape the ongoing traffic.

I know it can seem a bit strange but take time to read about it and you will understand the trick.

So the best way to do depends on what you want to achieve.

[adambomb1219]

I agree, what is the use-case here?

[it-andreagx]

@AEK @adambomb1219 

The case use is limit the bandwith from some remote locations (that runs proxies), to a Zabbix server.

I want that the inbound traffic do not exceed the threshold (100kbps)

PS the upload segment of the our ADSL line is very limited (512k) 

[AEK]

In that case I'd install remote zabbix collectors (proxy) and only collectors send to central server (edit: use zabbix proxy compression when available) and I'd filter the sent data at the source from clients, sending only important info.

Shaping traffic randomly on FGT may drop important and non-important data equally, and I'm sure you'll have many false positives in your zabbix dashboard.

[sahmed_FTNT]

Hello, you can use a reverse shaper limit the traffic