Traffic Shaper Profile while matching tos/tos-marsk

[JTForti]

Having is issues using a Traffic Shaper Profile with Traffic Class IDs to match traffic to shape based upon tos/tos-mask values. I will post the config below, not sure what exactly is going on.  Wondering if this is even supported. This is off a FortiGate 201F. All I get are matched for the Default class-id nothing else. I have verified sending traffic marked with EF and AF21 so it should have marked it, but doesn't appear to be doing that with the Traffic Shaper.

config firewall traffic-class

    edit 2

        set class-name "Voice_Class"

    next

    edit 3

        set class-name "Emergency_Voice_Class"

    next

    edit 4

        set class-name "Video_Class"

    next

    edit 5

        set class-name "Application_Class"

    next

    edit 6

        set class-name "BestEffort_Class"

    next

config firewall shaping-policy

    edit 2

        set uuid 9c15e226-3070-51ee-9253-a3d92134b031

        set name "Voice"

        set service "ALL"

        set schedule "always"

        set srcintf "any"

        set dstintf "port1"

        set tos 0xb8

        set tos-mask 0xfc

        set class-id 2

        set diffserv-forward enable

        set srcaddr "all"

        set dstaddr "all"

        set diffservcode-forward 101110

    next

    edit 3

        set uuid 9eac7c70-3070-51ee-53f6-0a3040f06758

        set name "Emergency_Voice"

        set service "ALL"

        set schedule "always"

        set srcintf "any"

        set dstintf "port1"

        set tos 0x68

        set tos-mask 0xfc

        set class-id 3

        set diffserv-forward enable

        set srcaddr "all"

        set dstaddr "all"

        set diffservcode-forward 011010

    next

    edit 4

        set uuid a542f7b2-3070-51ee-1c9d-1d0694045d4d

        set name "Video"

        set service "ALL"

        set schedule "always"

        set srcintf "any"

        set dstintf "port1"

        set tos 0x88

        set tos-mask 0xfc

        set class-id 4

        set diffserv-forward enable

        set srcaddr "all"

        set dstaddr "all"

        set diffservcode-forward 100010

    next

    edit 5

        set uuid ab54c996-3070-51ee-c3cd-50cd9c1840d4

        set name "Application"

        set service "ALL"

        set schedule "always"

        set srcintf "any"

        set dstintf "port1"

        set tos 0x48

        set tos-mask 0xfc

        set class-id 5

        set diffserv-forward enable

        set srcaddr "all"

        set dstaddr "all"

        set diffservcode-forward 010010

    next

    edit 6

        set uuid b2352d46-3070-51ee-1ef3-7a8dae7b242b

        set name "BESTEFFORT"

        set service "ALL"

        set schedule "always"

        set srcintf "any"

        set dstintf "port1"

        set class-id 6

        set diffserv-forward enable

        set srcaddr "all"

        set dstaddr "all"

    next

end

config firewall shaping-profile

    edit "WAN_SHAPER"

        set default-class-id 6

        config shaping-entries

            edit 3

                set class-id 6

                set priority low

                set guaranteed-bandwidth-percentage 70

                set maximum-bandwidth-percentage 100

            next

            edit 1

                set class-id 2

                set priority top

                set guaranteed-bandwidth-percentage 20

                set maximum-bandwidth-percentage 100

            next

            edit 2

                set class-id 5

                set priority medium

                set guaranteed-bandwidth-percentage 10

                set maximum-bandwidth-percentage 100

            next

        end

config system interface

    edit "port1"

        set vdom "root"

        set type physical

        set outbandwidth 100000

        set egress-shaping-profile "WAN_SHAPER"

        set lldp-reception enable

        set role wan

        set snmp-index 3

FortiGate-201F # diag netlink interface list port1

if=port1 family=00 type=1 index=7 mtu=1500 link=0 master=0

ref=29 state=start present fw_flags=10000 flags=up broadcast run multicast

Qdisc=mq hw_addr=ac:71:2e:d2:45:4c broadcast_addr=ff:ff:ff:ff:ff:ff

egress traffic control:

        bandwidth=100000(kbps) lock_hit=0 default_class=6 n_active_class=3

        class-id=6      allocated-bandwidth=70000(kbps)         guaranteed-bandwidth=70000(kbps)

                        max-bandwidth=100000(kbps)      current-bandwidth=9(kbps)

                        priority=low    forwarded_bytes=4262

                        dropped_packets=0       dropped_bytes=0

        class-id=5      allocated-bandwidth=10000(kbps)         guaranteed-bandwidth=10000(kbps)

                        max-bandwidth=100000(kbps)      current-bandwidth=0(kbps)

                        priority=medium         forwarded_bytes=0

                        dropped_packets=0       dropped_bytes=0

        class-id=2      allocated-bandwidth=20000(kbps)         guaranteed-bandwidth=20000(kbps)

                        max-bandwidth=100000(kbps)      current-bandwidth=0(kbps)

                        priority=top    forwarded_bytes=0

                        dropped_packets=0       dropped_bytes=0

stat: rxp=1019337 txp=1038913 rxb=64727420 txb=74313546 rxe=0 txe=0 rxd=0 txd=0 mc=0 collision=0 @ time=1691605882

re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0

te: txa=0 txc=0 txfi=0 txh=0 txw=0

misc rxc=0 txc=0

input_type=0 state=3 arp_entry=0 refcnt=29

[pavankr5]

Hello,

Ensure that the traffic you're sending into the FortiGate firewall is actually being marked with the appropriate TOS values. Need to check that the TOS and TOS-Mask values you're using in your shaping policies match the actual TOS values applied to the traffic.  Verify that the Class-IDs you've assigned to your traffic classes in the shaping-policy section are correctly mapped to the corresponding traffic classes defined in the traffic-classes section.

Please let us know if you have any queries.

Thanks