On both Fortigate firewalls there is an access with OpenVPN. On the OpenVPN server the public ip addresses are bound, which I address as OpenVPN user. The firewall forwards the requests to the OpenVPN (port 443) server by policy. This also works without problems.
Now I want to activate traffic shaping for this connection. 200MBit should be guaranteed. A maximum bandwidth limit is not necessary. The configuration is the same on both Fortigates.
The problem is, I don't see any traffic in the Traffic Shaper overview. Also with the following cli command I don't see any traffic: diagnose firewall shaper traffic-shaper list
Public IP example: 188.8.131.52 (bound on the OpenVPN server behind the firewall)
(The other firewall use a another public ip which is bound also on the OpenVPN server)
config firewall policy edit 96 set name "OpenVPN access" set uuid xxxxxxxxxxx set srcintf "x1" set dstintf "x2" set srcaddr "all" set dstaddr "184.108.40.206" set action accept set schedule "always" set service "HTTPS" set logtraffic all next
config firewall shaper traffic-shaper edit "OpenVPN-guarantee" set guaranteed-bandwidth 200000 next
config firewall shaping-policy edit 1 set name "OpenVPN admin-traffic" set service "HTTPS" set dstintf "x2" set traffic-shaper "OpenVPN-guarantee" set traffic-shaper-reverse "OpenVPN-guarantee" set srcaddr "all" set dstaddr "220.127.116.11" next
Changing the configuration is not possible. The reason is that the OpenVPN access is actively used by the admins and everyone else working on the systems. Changing the configuration would certainly ensure that the colleagues cannot work for a certain time. In addition, the OpenVPN access is also our administrative access, which we need, because the servers behind the firewall are located in a different place than the colleagues.
Based on your config I assumed "18.104.22.168" is just a public IP address on the server and this FGT is routing without DNAT. Then if you match traffic with a shaping-policy + a shaper, you should see some traffic matching with the shaper when it's really happening, just like below for our guest wifi.
name GuestWiFiShaper maximum-bandwidth 1875 KB/sec guaranteed-bandwidth 500 KB/sec current-bandwidth 956 B/sec <-- Byte/sec, not bit/sec priority 3 overhead 0 tos ff packets dropped 0 bytes dropped 0
But if you are to limit traffic to keep some bandwidth for management, you're suposed to set the limit with "maximum-bandwidth" like what we have for this wifi shaper.
edit "GuestWiFiShaper" set guaranteed-bandwidth 4000 set maximum-bandwidth 15000 set priority medium next
Then to tackle with DOS attach to the "22.214.171.124" server, sniff the traffic against the IP to find sources of DOS(likely SYN flooding) attacks. Then find the countries and put Geo block policy above the forwarding policy. That's what we did to mitigate the same situation for one of our portal servers.
No way to counter a DDoS attack with simply shaping the traffic, DDoS saturates the whole internet link, from your ISP to your FGT. Something like FortiDDoS can stop DDoS just because it collaborates with ISP, in such way that your ISP will not send you further DDoS traffic.
To access your admin console when a DDoS attack is ongoing you have to do it out of band, e.g.: from another internet link.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.