Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
journeyman
Contributor

Traffic shaping per destination IP, FGT 60C 4.0 MR1

We wish to shape traffic from a server per destination ip. The test to one device doesn' t work so far. I know it' s an old firmware version in the FGT. server1 initiates a connection via a FGT 60C to remotes [device1, device2.. deviceN]. Each remote device communicates over a low bandwidth connection. The remote connections also carry a voip-like traffic stream which it is more important (voip traffic does not touch the FGT). Normal traffic from the server to each device is no problem. However the server can initiate a firmware update which generates sufficient throughput to cause errors on the voip. So we want to restrict traffic from the server to a maximum of say 32kbps per remote device. Sounds like per-ip to me. In testing to one device only, our per-ip configuration does not work. The per-ip shaper is configured. Action = none and quota = 0 (the defaults) - our concern is bandwidth only, not total throughput. The firewall policy calls the shaper:
config firewall shaper per-ip-shaper
 edit " restrict-traffic" 
     set bps 32
     config iplist
         edit 1
         set end <server-ip>
         set start <server-ip>
         next
     end
 next
 end
 config firewall policy
 edit 123
     set src-addr <server-ip>
     set dst-addr <test-device>
     set per-ip-shaper " restrict-traffic" 
 next
 end
The active session is handled by the expected policy id 123. Initially the ip-list was set to the remote ip address; upon reading the cli manual more carefully this has been changed to the server ip address (and existing sessions deleted). In both cases the shaper does not operate as expected. Can anyone suggest what is missing or wrong? What is the best way to achieve our requirement, preferably without creating a policy per remote device?
3 REPLIES 3
ede_pfau
SuperUser
SuperUser

For starters, per-IP-shaper limits traffic bw " per source IP" . So you were right to specify your server' s IP address. After checking the 4.1 CLI reference I do not think that this feature will do what you want to achieve. Functionality has changed in later releases to " throttling" (dropping packets to obtain the specified bandwidth on average). In 4.1 you can only block traffic that exceeds the bw limit, or log the event. BTW, I cannot see what the value for the " action" is in your config (as I don' t know what the default is). In any case I' d upgrade to at least 4.3.17. That will do - I' m using it in a 50B.
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
journeyman

Thanks for your replies. Originally the quota settings were left at their defaults
 set action none
 set type hour
 set quota 0
and subsequently changed to
 set action block
 set type hour
 set quota 5
A quota of 5MB per hour should be enough for normal data and a firmware download. However neither of the above successfully constrained the bandwidth throughput. I' ll go with " need to update the firmware" but given the overall functionality of the device this will be quite a task.
lightmoon1992
New Contributor

in later releases, you can apply application control while defining traffic shappers within the profile. i believe this would work it out

Mohammad Al-Zard

 

Mohammad Al-Zard
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors