Traffic Shaper from external not work

[Holger_B]

Hello Community,

Fortigate:
1500D v5.6.12
200F v6.4.8

On both Fortigate firewalls there is an access with OpenVPN.
On the OpenVPN server the public ip addresses are bound, which I address as OpenVPN user. The firewall forwards the requests to the OpenVPN (port 443) server by policy. This also works without problems.

Now I want to activate traffic shaping for this connection.
200MBit should be guaranteed. A maximum bandwidth limit is not necessary. The configuration is the same on both Fortigates.

The problem is, I don't see any traffic in the Traffic Shaper overview. Also with the following cli command I don't see any traffic:
diagnose firewall shaper traffic-shaper list

current-bandwidth always stays at 0b/sec

Where did I make the configuration error here?

x1 = external interface (10Gbit)
x2 = internal interface (10Gbit)

Public IP example:
123.123.123.123 (bound on the OpenVPN server behind the firewall)

(The other firewall use a another public ip which is bound also on the OpenVPN server)

config firewall policy
edit 96
  set name "OpenVPN access"
  set uuid xxxxxxxxxxx
  set srcintf "x1"
  set dstintf "x2"
  set srcaddr "all"
  set dstaddr "123.123.123.123"
  set action accept
  set schedule "always"
  set service "HTTPS"
  set logtraffic all
next

config firewall shaper traffic-shaper
  edit "OpenVPN-guarantee"
  set guaranteed-bandwidth 200000
next

config firewall shaping-policy
edit 1
  set name "OpenVPN admin-traffic"
  set service "HTTPS"
  set dstintf "x2"
  set traffic-shaper "OpenVPN-guarantee"
  set traffic-shaper-reverse "OpenVPN-guarantee"
  set srcaddr "all"
  set dstaddr "123.123.123.123"
next

Regards
Holger

[Toshi_Esumi]

One thing I can tell is "diag firewall shaper traffic-shaper list" shows the number (last 1 sec) for matching traffic coming through CPU. So try disable NPU offloading on the policy with below:

   set auto-asic-offload disable

Don't forget to remove it when you're done with testing. It would affect to its performance.

Toshi

[Holger_B]

Hello Toshi_Esumi,

thank you for your answer.

I activate the setting "set auto-asic-offload disable" for the firewall policy and started again my tests, with the same result as before. No traffic was shown for the traffic shaper.

After the test i removed the setting.

[seshuganesh]

As per my understanding traffic shaping will happen after portforwarding.

Can you configure destination address as open vpn server private ip and then check if traffic shaper is getting triggered or not

[Holger_B]

Hello ,

thank you for your answer.

Changing the configuration is not possible. The reason is that the OpenVPN access is actively used by the admins and everyone else working on the systems.
Changing the configuration would certainly ensure that the colleagues cannot work for a certain time.
In addition, the OpenVPN access is also our administrative access, which we need, because the servers behind the firewall are located in a different place than the colleagues.

[Holger_B]

Maybe a short explanation of the purpose of the Traffic Shaper.

Some time ago we had a DDOS attack on one of the services offered by one of the firewalls. An administrative login was difficult to achieve.

The Fortinet customer support recommended us to guarantee a certain bandwidth for the administrative access and to realize this with Traffic Shaping.

[Toshi_Esumi]

Those are two different things.

Based on your config I assumed "123.123.123.123" is just a public IP address on the server and this FGT is routing without DNAT. Then if you match traffic with a shaping-policy + a shaper, you should see some traffic matching with the shaper when it's really happening, just like below for our guest wifi.

name GuestWiFiShaper
maximum-bandwidth 1875 KB/sec
guaranteed-bandwidth 500 KB/sec
current-bandwidth 956 B/sec   <-- Byte/sec, not bit/sec
priority 3
overhead 0
tos ff
packets dropped 0
bytes dropped 0

But if you are to limit traffic to keep some bandwidth for management, you're suposed to set the limit with "maximum-bandwidth" like what we have for this wifi shaper.

edit "GuestWiFiShaper"
  set guaranteed-bandwidth 4000
  set maximum-bandwidth 15000
  set priority medium
next

Then to tackle with DOS attach to the "123.123.123.123" server, sniff the traffic against the IP to find sources of DOS(likely SYN flooding) attacks. Then find the countries and put Geo block policy above the forwarding policy. That's what we did to mitigate the same situation for one of our portal servers.

Toshi

[AEK]

No way to counter a DDoS attack with simply shaping the traffic, DDoS saturates the whole internet link, from your ISP to your FGT. Something like FortiDDoS can stop DDoS just because it collaborates with ISP, in such way that your ISP will not send you further DDoS traffic.

To access your admin console when a DDoS attack is ongoing you have to do it out of band, e.g.: from another internet link.

PS: DoS is stoppable by FGT, while DDoS is not.