Traffic Shaping Query

[snagrat]

I am looking at implementing a Traffic Shaping policy so a particular IP range has an a guaranteed 100Mbps bandwidth on our 300Mbps leased line.

I have created the policy now I need to enable it. Do I create a new firewall policy ensuring it is above the current rules?

Will the policy be:

Source = IP Range

Destination = All

Service = Web Browsing

Traffic Shaping = ON Shared Shaper

Once enabled will other IP ranges be limited to 200Mbps, or will they only drop to 200Mbps when the shaping is required (i.e If no IPs on the shaper policy are connected to the internet)

[Toshi_Esumi]

First, are you running 5.4 or above, or 5.2 or below? If the former, I recommend using shaping-policy instead of FW policy, which FTNT TAC recommended to us. Create a shaping-policy to match the same conditions and apply the shaper you created.  If you want to limit the others at 200Mbps, you need to create another shaper&shaping-policy to catch all the others and set the limit. And this is the handbook for 5.4.0. https://docs.fortinet.com...traffic-shaping-54.pdf

[snagrat]

We are running 5.2

So the FW policy seems to be the route to go?

[Toshi_Esumi]

Yes, if that's the case. Then you have to create a new FW policy to match only those first and place it at the top. Then you have to worry about all the other existing policies to see which ones would affect to "the others" to cap at 200Mbps and apply the second shaper to all of those.

[snagrat]

I don't specifically want to cap the others to 200Mbps, I was just wondering how "the others" would behave when I enable a shaping policy to one set of IPs.

Will "the others" be allowed to use more than 200Mbps when the shaping policy clients are not touching their 100Mbps allocation?

Hope that makes sense

[Toshi_Esumi]

My understanding is if you don't cap the others it can use up the entire bandwidth.

[rwpatterson]

Also do a "show full-configuration". In the global section, check the default bandwidth priority. I believe it is high, so you may need to drop it for the new policy to take effect.

    set tos-based-priority medium

Gateway # config system global
Gateway (global) #     set tos-based-priority ?
high      high priority
low       low priority
medium    medium priority