FCP: Firewall Policies and Traffic Shaping

Firewall Policies and Traffic Shaping tests policy evaluation, NAT behavior, and how FortiOS enforces bandwidth. Expect scenario questions where a policy is bypassed, a shaper does not apply, or NAT changes the match criteria.

Policy evaluation rules

• Policies are evaluated top-down; first match wins.
• The implicit deny at the bottom drops unmatched traffic and logs it only if the setting is enabled.
• Address, service, user, schedule, and security profiles are match criteria; profiles apply only on accept.
• NAT is configured per policy; central NAT is an alternative applied before policy lookup.
• Policy IDs can be reordered; policy routes can override routing but not security policy order.

Shaping models

• Shared shaper: one bandwidth pool for all traffic matching the shaping policy.
• Per-IP shaper: each source IP gets its own instance of the shaper.
• Traffic shaping policies match by application, user, URL category, or address and can assign a shaper or change priority.
• Guaranteed bandwidth is honored only during congestion; maximum bandwidth caps the flow.
• Reverse shaper applies to return traffic when asymmetric paths exist. Shaping can also be applied directly on a firewall policy with a shared shaper, but traffic shaping policies offer application-level granularity.

Worked example

A guest network must be capped at 20 Mbps aggregate. Create a shared traffic shaper with maximum bandwidth 20000 Kbps, then a traffic shaping policy matching the guest subnet and outgoing interface wan1 with action shape and that shaper. Because it is shared, all guests share 20 Mbps. If the requirement were 20 Mbps per guest, choose a per-IP shaper; with 50 guests the aggregate could reach 1000 Mbps, which the WAN link may not support. That is why per-IP shapers need an overall link cap or a shared shaper on the parent policy.

Traps

• A traffic shaping policy does not reorder firewall policy enforcement; shaping is a separate evaluation.
• Shapers do not create bandwidth; guaranteed bandwidth can be overcommitted.
• Policy NAT changes the source address before shaping if shaping matches post-NAT addresses.

Key points

• First matching firewall policy wins; implicit deny handles the rest.
• Shared shapers pool bandwidth; per-IP shapers instantiate per source address.
• Guaranteed bandwidth applies under congestion; maximum bandwidth is a hard cap.
• Central NAT is evaluated before policy lookup, unlike per-policy NAT.
• Shaping policies can match applications and users, not only addresses.