Technical Tip: Traffic Shaping on a FortiGate Chassis

sbaikadi · ‎11-07-2023

Description

This article describes how Traffic shaping is applied on a FortiGate chassis and how to check if shaping is applied as desired.

Scope

FortiGate 6000 and 7000 Series

Solution

For traffic shapers in the SLBC platform (6000 and 7000 Series), the shaper is applied per blade/slot, not per chassis.
In the 6000/7000 series, traffic is load-balanced to all of the blades in the chassis. Blades can be considered as an individual FortiGate (like 3800D). These individual FortiGates apply traffic shaping quotas independently. When traffic is received by the Blade (FortiGate), traffic shaping is applied to the traffic that is processed by that blade in the same way that this occurs on a regular FortiGate. This may sometimes allow more traffic than expected as the traffic is load-balanced to different blades based on the hashing algorithm on 6K/7K.
The configuration for traffic shaping defined in the shaper is synced with each FPC/FPM in the chassis.
Each FPC/FPM will shape the traffic as per the bandwidth configured on the blade.
For Example: The traffic received on the MBD/FIM on the chassis will be load-balanced to the slots/blades in the chassis. If 60Mbps of bandwidth is configured to be shaped for the traffic on the MBD/FIM, each slot/blade in the chassis will shape 60Mbps of traffic that is hitting that particular blade.
(Note: If the chassis has 6 Slots, the total bandwidth shaped by the chassis in this case will be 6 x 60 Mbps = 360 Mbps.)
The allocated BW for each FPC can be seen from the CLI using the following command:

diagnose firewall shaper traffic-shaper list

Troubleshooting commands:

To check if traffic is being shaped, look for 'originshaper=' in the output of 'diag sys session list':

diagnose firewall shaper traffic-shaper stats

diagnose firewall shaper traffic-shaper list name xxxx

diagnose firewall shaper traffic-shaper stats clear (To clear the statistics.)

Debug flow messages show drops due to the shaper with the message 'exceeded shaper limit, drop'.

Add a FortiView Dashboard widget to monitor the traffic-shaping. See 'To add a FortiView widget in the dashboard' on this page of the FortiGate cookbook.