Hello, we share the bandwith of an ISP uplink on a Fortigate (FWF60E, v6.2.7) to connect a VPN tunnel to a central hub but also to provide local internet access for users and systems connected on the fortigate. I want to control the bandwith of the WAN uplink by applying traffic shaping policies. Limiting and prioritizing the user traffic is not an issue. But is it possible to control also the local tunnel traffic (IKE and ESP) on the uplink?
I my test configuration (s.below) I built a shaper by specifying the tunnel destination IP and the protocols ike and esp (source is dynamic address). But when verifying the diag outputs, it seems, that the shaper is not able to match on local generated traffic. Is this true, and if yes, is there an alternative, to control the tunnel traffic on the shared uplink?
A sample configuration could look like this:
- User realtime internet traffic, min. 5M, max. unlimit, prio High
- Local VPN Traffic (tunnel to central hub), min. 20M, max. unlimit, prio Medium (???)
- User internet traffic, min. 5M, max. unlimit, prio Low
Many thanks in advance! Hakan