Traffic shaping per destination IP, FGT 60C 4.0 MR1

[journeyman]

We wish to shape traffic from a server per destination ip. The test to one device doesn' t work so far. I know it' s an old firmware version in the FGT. server1 initiates a connection via a FGT 60C to remotes [device1, device2.. deviceN]. Each remote device communicates over a low bandwidth connection. The remote connections also carry a voip-like traffic stream which it is more important (voip traffic does not touch the FGT). Normal traffic from the server to each device is no problem. However the server can initiate a firmware update which generates sufficient throughput to cause errors on the voip. So we want to restrict traffic from the server to a maximum of say 32kbps per remote device. Sounds like per-ip to me. In testing to one device only, our per-ip configuration does not work. The per-ip shaper is configured. Action = none and quota = 0 (the defaults) - our concern is bandwidth only, not total throughput. The firewall policy calls the shaper:

config firewall shaper per-ip-shaper
 edit " restrict-traffic" 
     set bps 32
     config iplist
         edit 1
         set end <server-ip>
         set start <server-ip>
         next
     end
 next
 end
 config firewall policy
 edit 123
     set src-addr <server-ip>
     set dst-addr <test-device>
     set per-ip-shaper " restrict-traffic" 
 next
 end

The active session is handled by the expected policy id 123. Initially the ip-list was set to the remote ip address; upon reading the cli manual more carefully this has been changed to the server ip address (and existing sessions deleted). In both cases the shaper does not operate as expected. Can anyone suggest what is missing or wrong? What is the best way to achieve our requirement, preferably without creating a policy per remote device?

[ede_pfau]

For starters, per-IP-shaper limits traffic bw " per source IP" . So you were right to specify your server' s IP address. After checking the 4.1 CLI reference I do not think that this feature will do what you want to achieve. Functionality has changed in later releases to " throttling" (dropping packets to obtain the specified bandwidth on average). In 4.1 you can only block traffic that exceeds the bw limit, or log the event. BTW, I cannot see what the value for the " action" is in your config (as I don' t know what the default is). In any case I' d upgrade to at least 4.3.17. That will do - I' m using it in a 50B.

[journeyman]

Thanks for your replies. Originally the quota settings were left at their defaults

 set action none
 set type hour
 set quota 0

and subsequently changed to

 set action block
 set type hour
 set quota 5

A quota of 5MB per hour should be enough for normal data and a firmware download. However neither of the above successfully constrained the bandwidth throughput. I' ll go with " need to update the firmware" but given the overall functionality of the device this will be quite a task.

[lightmoon1992]

in later releases, you can apply application control while defining traffic shappers within the profile. i believe this would work it out