traffic shaping on asynchronous internet connection

[Eric_Brown]

Hi folks. I'm trying to figure out a good way to deal with an asynchronous connection. I'd love it if someone could read through this and make sure I have my head on straight.

We get 50Mbps down and 5Mbps up from our ISP. Upstream gets saturated frequently, which limits our effective downstream throughput (I've had a couple executives ask for new computers because their old ones were getting "slow." Try explaining to the CEO that a new computer isn't going to make Gmail any faster, and that funds would be better spent on a synchronous fiber connection...).

The only way I can think of to control this is to create two sets of traffic shapers -- one for upstream, one for downstream, and then try to apply them to very specific applications. For example, to keep dropbox from sucking all the air out of the room, I would have to apply a 3000Kbps max throughput traffic shaper very specifically to the application sensor signature, "Dropbox_File.Upload." It seems impractical and wasteful to do this for every single application signature. I know I could apply a traffic shaping policy to the reverse direction of the security policy, but my understanding is that bandwidth is already divided equitably among sessions in a policy. Since Fortigate doesn't have the ability to define policies around application lists, there's no way to use this effectively. Is there anything I'm missing here? I realize the real answer is "get moar bandwidth," and we're working on it, but in the meantime, is there another way to deal with this problem?

Thanks. Eric

Fortigate 60C

Firmware Version v5.2.7,build718 (GA)

[emnoc]

will for asymmetrical connection is common to have this but you have other options,

1: run netflow and determine what traffic types are happening during periods of congestion

2: tighten fwolicy enforce for ; unwanted traffic, TOD access,

3: install webcache to reduce traffic that repetitive and for caching objects within the cache

btw: your not going to effectively TS traffic flow inbound from the wan  ( tcp , icmp or udp )