Query - How to achieve Bandwidth Capping with Traffic Shaping for LAN User Based Settings

[joshiamarpreet]

Setup required as follows: -

In office LAN- User logs into PC/ Laptop with authentication and gets access to internet.

Internet usage capping is done on particular user/ group (example- 10GB daily traffic is assigned). Currently we are achieving this via web filter security profile usage capping bandwidth quota in proxy mode. 

Post user/ group has consumed the 10gb daily traffic; automatically the speed should reduce as per traffic shaping applied.

Query here: -

How to set it to daily usage for the amount of GB traffic capped.

How to configure firewall to automatically allow traffic shaping applied over users in scope once they have consumed daily traffic allowance.

Is it possible even or not to achieve such use case?

Kindly confirm.

User are authenticated via LDAP in FortiGate.

[gfleming]

AFAIK there is no way to do this directly in the GUI or CLI. I could be wrong though!

One way around it could be to look for relevant log message for web filter quota being reached and auotmate a trigger to enable the traffic shaper. And have another automation stitch that removes the shaper every day at midnight?

https://docs.fortinet.com/document/fortigate/7.2.3/fortios-log-message-reference/12802/12802-log-id-...

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/351998/creating-automation-s...

[joshiamarpreet]

With automaton we can achieve one thing which is: -

Disabling the policy where we have applied user based web filtering quota service.

This can be done by "action" under automation by running a CLI script. Which will disable the policy and hence now users will still be allowed to use internet but as per traffic shaping profile.

But

point here is that how to make a trigger which senses that capping limit is over. which will then further trigger this action.

[gfleming]

I just assumed the capping limit would be over at the end of the day which is why I suggested a new automation stitch to re-enable the web filter policy at midnight or some other time. Does that work?

However I just realized if you are trying to do this per-user and not based on a group of users it might not be possible.

What is the ultimate goal? Are you trying to reduce overall bandwidth usage for a group of users? Could accomplish with traffic shaper on interface.

[joshiamarpreet]

Lets say:

You reached the office and logged into your PC, per day bandwidth allowance is 10GB and you finishes that usage in 4 hours. You still have rest of the hours available within which you are going to work in office. But now your speed will be reduced to lets say 1mbps as per traffic shaping applied.

Here I'm not sure if the same web filter profile could work per user or only on a  group of user.

Also post capping limit is over, how it triggers the usage of traffic shaping which will then apply reduced speed surfing for end users.

[gfleming · Accepted solution]

Yea fairly certain this won't work on FortiGate as you want it to. Web Filter quota is per user.

Why do you want to limit users to 10GB of daily web traffic? Assuming you are trying to preserve bandwidth usage on your WAN link a better way to do this would be traffic shapers. You can tune these quite nicely to fit your needs. You can also review FortiView logs and analysis to see which type of traffic is using most bandwidth and apply a shaper to that specific type of traffic only.

[joshiamarpreet]

This setup is a use case for school students where we are limiting per day data and post consumption limiting speed for the rest of the day.

[gfleming]

There should be a rationale for that though. What is the rationale? Is it to limit overall bandwidth usage? Is it because you are charging studnets based on data used? etc, etc

If it's bandwidth management only, consider per-IP shaper. Each student gets a max amount of bandwidth to use. Give them something reasonable so they can still use most services but can't abuse it.

[joshiamarpreet]

Charging is never the case. 
And per ip will not work here. IP assignments are dynamic. 

Also traffic shaping from first place itself is not the scene. That is not the use case. Post certain traffic allowance only we need to apply shaper to limit it. 

Dedicated solution to understand the use case- you can look into solutions like 24online or Riverbed. 

[gfleming]

Per-IP shaping works with dynamic assignements.

So I'm still trying to understand your use-case. What is the business requirement. Why do you want to give 10GB/day and then throttle it afterwards?

For example in a mobile LTE environment this makes sense because customers pay for a certain amount like 25GB/month and then get throttled afterwards.

What is your requirement that is dictating the configuration? If you can share this we can propose alternative solutions that may work.