If you have ever tried to watch a video while your housemate is gaming and the video keeps buffering, you have experienced a network without Quality of Service. Traffic shaping and QoS are the tools that let an IT professional decide which internet traffic gets treated like a VIP and which can wait, so that important tasks like video calls or critical business data always get through.
Jump to a section
A simple way to picture Traffic Shaping and Quality of Service (QoS)
A head chef runs a busy restaurant kitchen during Friday night dinner service. Orders come in constantly. The kitchen has limited stoves, ovens, and prep space. If the chef lets every order through at once, chaos erupts. Cooks bump into each other, ovens overheat, soufflés collapse, and customers wait forever or get cold food. The chef must decide which orders get priority. A VIP guest's steak gets fired immediately. A large table's multiple dishes get spaced out so they all arrive together. A simple salad gets delayed if the line is already slammed with searing steaks. This is traffic shaping. The head chef also practises quality of service by guaranteeing each table gets at least its bread basket within five minutes, ensuring no table is entirely ignored. The chef sets bandwidth limits: the fryer station can only handle ten baskets of chips at once. New orders for chips get queued or rejected. If the kitchen is drowning, the chef tells the front-of-house to stop taking new orders for a while. That is a traffic policy in action. The chef uses these rules so the restaurant survives the rush, customers leave happy, and the kitchen staff don't quit. Without this, the kitchen burns out, orders fail, and the restaurant gets terrible reviews. That is exactly what traffic shaping and QoS do for a computer network.
Traffic shaping and Quality of Service (QoS) are techniques used on a network to manage data traffic so that important data gets priority and bandwidth is used efficiently. Think of a network as a highway. Without any rules, every car (data packet) competes for the same space, leading to jams and crashes. Traffic shaping and QoS are the traffic management system that keeps things moving.
First, let's define some key terms. A network is a group of computers and devices connected so they can share data. Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, like the number of lanes on a highway. More bandwidth means more data can flow at once. A data packet is a small unit of data sent over a network. All data you send or receive is broken into packets.
QoS is a set of technologies that gives different types of traffic different levels of priority. It does not increase bandwidth. Instead, it makes sure that when the network gets busy, the most important data gets through first. Traffic shaping is one method used to implement QoS. It controls the volume of traffic being sent into the network and can delay some packets to prevent congestion.
Why does this exist? Before QoS, networks used a best-effort model. All packets were treated equally. If the network got congested, packets were dropped at random. This is fine for email or file downloads, but terrible for real-time applications like voice calls or video conferencing where a dropped packet means a garbled word or frozen image.
How does it work? Traffic shaping uses two main actions: prioritisation and rate limiting. - Prioritisation: The network device (like a FortiGate firewall) looks at each packet and decides its priority based on rules. These rules can be based on the type of traffic (like voice or video), the source or destination address, or the application. High-priority traffic, like a VoIP call, gets a dedicated slot in the queue (the waiting line). Low-priority traffic, like a large file download, gets a less favourable slot. - Rate limiting: This is the shaping part. You set a maximum speed for a certain type of traffic. If a user is downloading a huge file, you can limit that download to 1 Mbps, leaving the rest of the bandwidth free for other users. This prevents one application from soaking up all the available bandwidth.
Traffic shaping also uses buffers. A buffer is a temporary storage area for data packets. When too many packets arrive at once, the router holds some in a buffer instead of dropping them. This smooths out bursts of traffic. However, buffers have a limit. If they fill up, packets are dropped. This is called tail drop.
QoS can be implemented in several ways. One common method is class-based QoS. You create classes of traffic, such as "voice", "video", "business-critical", and "best-effort". You then assign a minimum guaranteed bandwidth to the higher classes (so voice always has enough) and a maximum limit on the lower classes (so best-effort traffic cannot starve the others).
Another method is using DiffServ (Differentiated Services). In this model, a device marks each packet with a specific value in its header (the packet's label). This value tells downstream routers how to treat that packet. This is like putting a VIP badge on a package in a postal service. Routers along the path see the badge and give it faster handling.
On a FortiGate firewall, you set up traffic shaping through policies. You create a traffic shaper that defines the maximum and guaranteed bandwidth for a type of traffic. Then you link that shaper to a firewall policy. When traffic matches that policy, it is shaped according to the shaper's rules. You can also use per-IP shapers to limit each individual user.
QoS replaces the old best-effort model with a structured, predictable system. It does not fix a network that is permanently overloaded, but it does make sure that during temporary congestion, the most important work gets done.
Analyse current traffic patterns
Use the FortiGate traffic logs or dashboard to identify which applications consume the most bandwidth and which are critical. This tells you what needs shaping and what your priorities should be.
Define traffic classes and priorities
Group traffic into categories like Voice, Video, Business Critical, and Best Effort. Assign each a priority level (higher number = higher priority). This is the conceptual blueprint for your QoS policy.
Create shared traffic shapers for each class
On the FortiGate, navigate to Policy & Objects > Traffic Shaping > Shaping Policy. Create a shaper for each class. For high-priority classes, set a guaranteed bandwidth. For low-priority classes, set a maximum bandwidth limit. This controls the bandwidth each class can use.
Attach shapers to firewall policies
Go to the firewall policy that matches the traffic (e.g., the policy allowing VoIP). In the policy settings, enable traffic shaping and select the corresponding shaper. Now the shaper is enforced whenever that traffic flows through the policy.
Create per-IP shapers for user control
If you want to stop individual users from hogging bandwidth, create a per-IP shaper. In a firewall policy that matches general user traffic, attach this per-IP shaper. Set the maximum bandwidth per IP (e.g., 2 Mbps). This ensures no single user can exceed that limit.
Test and monitor results
After applying the shapers, run tests. Simulate network congestion (e.g., start a large download while on a VoIP call). Check the FortiGate traffic reports to see if high-priority traffic is getting its guaranteed bandwidth. Adjust the guaranteed and maximum values if needed.
Imagine you are an IT administrator for a mid-sized company called "GreenTech Ltd." The company has 200 employees who all use the internet for email, web browsing, and accessing cloud applications like Microsoft 365. The company also runs a real-time video surveillance system for the warehouse and uses VoIP phones for all customer calls.
The total internet bandwidth is a 200 Mbps fibre line. Without any traffic management, one employee watching 4K YouTube videos could saturate the link, causing everyone else's video calls to stutter and the warehouse cameras to lose frames. That is a disaster waiting to happen.
Here is what you, as the IT professional, actually do step by step:
Analyse the traffic: First, you log into the FortiGate firewall and look at the traffic logs. You identify the top bandwidth consumers. You see that employee Bob is streaming Netflix during lunch, and the automatic software updates from a few servers are using large chunks of bandwidth.
Define traffic classes: You create five classes of traffic:
Class 1: Voice (VoIP calls, priority 5)
Class 2: Video surveillance (priority 4)
Class 3: Business applications (Microsoft 365, priority 3)
Class 4: Web browsing and email (priority 2)
Class 5: Everything else (streaming, downloads, priority 1)
Create traffic shapers on the FortiGate: You go to the Traffic Shaping section. For the Voice class, you create a shaper that guarantees 20 Mbps minimum and allows up to 50 Mbps. For Video surveillance, you guarantee 10 Mbps. For the 'Everything else' class, you set a hard limit of 10 Mbps total. This means that even if Bob tries to stream Netflix, he gets no more than 10 Mbps collectively with everyone else in that class, leaving 190 Mbps for the important traffic.
Apply the shapers to firewall policies: You configure your firewall policies. The policy that allows VoIP traffic gets the Voice shaper attached. The policy for web traffic gets the Web browsing shaper. The FortiGate now automatically enforces these rules every time a packet matches the policy.
Monitor and adjust: A month later, you check the bandwidth reports. You notice the Video surveillance class is almost hitting its 10 Mbps limit during peak times, but the Voice class rarely uses more than 10 Mbps. You adjust the Video surveillance shaper to 15 Mbps and lower the voice guarantee slightly. You also enable per-IP shaping for the 'Everything else' class, so each user is limited to 2 Mbps. Bob can still stream, but in low quality, and he does not affect anyone else.
This real-world implementation ensures that every customer call is crystal clear, the warehouse video feeds are smooth, and the employees can still browse the web and check email without frustration.
The NSE4 exam (specifically exam objective 3.3) tests your ability to implement traffic shaping policies and QoS settings on a FortiGate firewall. You must understand the concepts, the FortiGate configuration, and common pitfalls.
What exactly does it test? Here is the breakdown of what to focus on:
The difference between guaranteed bandwidth and maximum bandwidth: This is a crucial distinction. Guaranteed bandwidth is the amount of bandwidth the traffic is always entitled to, even if the link is congested. Maximum bandwidth is the upper limit the traffic can reach if the link has spare capacity. The exam loves to ask which setting prevents a class from starving other classes. The answer is guaranteed bandwidth. Memorise this.
The two types of traffic shapers on FortiGate: Shared shaper and Per-IP shaper.
Shared shaper: Limits the total bandwidth used by a group of users or all traffic matching a policy. For example, shaping all YouTube traffic to 50 Mbps total.
Per-IP shaper: Limits bandwidth per individual IP address. For example, shaping each user to a maximum of 5 Mbps. The exam will ask which shaper to use to stop one user from hogging all bandwidth. The correct answer is Per-IP shaper.
Traffic shaping policies vs firewall policies: You must know that a firewall policy is the main rule (allow/deny traffic), and traffic shaping is a secondary action attached to that policy. The exam will test the order of operations: traffic is first matched to a firewall policy, and then the attached shaper is applied.
DiffServ marking and queueing: They may ask about Differentiated Services Code Point (DSCP) values. You do not need to memorise all DSCP values, but you need to know that marking traffic with a certain DSCP value allows routers downstream to prioritise it. FortiGate can mark or remark DSCP values.
Traps and common mistakes:
Trap 1: Confusing bandwidth with priority. A high-priority queue does not automatically give more bandwidth. It gives better treatment when there is congestion. The exam may present a scenario where you need more bandwidth for voice but your QoS settings only guarantee priority. The correct fix is to increase the guaranteed bandwidth, not just the priority.
Trap 2: Shaping traffic that is already shaped upstream. If your ISP shapes traffic, applying additional shaping on your FortiGate may not help. They may ask about the best place to shape traffic (at the edge of your network).
Trap 3: Forgetting that traffic shaping policies are applied after the firewall policy. If a firewall policy denies traffic, no shaping happens. If a firewall policy allows traffic without a shaper attached, the traffic goes through unshaped.
Key definitions to memorise:
QoS (Quality of Service): The overall ability to prioritise traffic.
Traffic shaping: The action of controlling traffic volume, often by delaying packets.
Bandwidth: Maximum data transfer rate.
Throughput: Actual data transfer rate over time.
Jitter: Variation in packet delay. QoS helps control jitter.
Latency: Delay a packet experiences. Shaping can increase latency for low-priority traffic.
Packet loss: When packets are dropped. QoS reduces packet loss for high-priority traffic.
Exam question pattern: They often give a scenario (e.g., "A company has voice traffic and file downloads on the same link. Voice calls are dropping. What should you configure?") Expect multiple-choice answers that mix up shaper types, bandwidth vs priority, and DSCP vs queue. The correct answer usually involves creating a shared shaper with a guaranteed bandwidth for voice and a maximum bandwidth for downloads.
Traffic shaping does not create bandwidth; it prioritises how existing bandwidth is shared during congestion.
A guaranteed bandwidth setting ensures a specific traffic type always gets at least that much capacity, even if the link is full.
A per-IP shaper limits the bandwidth for each individual IP address, preventing one user from monopolising the connection.
QoS and traffic shaping are applied as an action within a firewall policy, not as a standalone rule.
You must configure traffic shaping on both sides of the network (LAN and WAN) or use DSCP markings for end-to-end effectiveness.
Voice and video traffic benefits most from QoS because they are sensitive to jitter, latency, and packet loss.
These come up on the exam all the time. Here's how to tell them apart.
Guaranteed Bandwidth
The minimum amount of bandwidth a traffic class is always entitled to.
Even during congestion, this bandwidth is reserved and not taken by other traffic.
Ensures critical applications (like voice) always have enough capacity.
Maximum Bandwidth
The upper limit a traffic class can use when the link has spare capacity.
If reached, excess packets are delayed or dropped.
Prevents one traffic class from using all available bandwidth.
Shared Shaper
Limits the total bandwidth used by all traffic matching a policy.
Useful for shaping a whole category of traffic (e.g., all video streaming).
Does not control individual user consumption within that category.
Per-IP Shaper
Limits bandwidth for each individual IP address.
Prevents one user from monopolising the bandwidth.
Applied using the 'per-ip' shaper option in FortiGate.
Traffic Shaping
A broader concept that includes delaying or dropping packets to smooth traffic.
Can use buffers to store packets and send them later.
Aims to manage bandwidth allocation over time.
Rate Limiting
A stricter method that discards packets immediately when a threshold is exceeded.
Often used for rate limiting per user or interface.
Simpler but can cause more packet loss.
Mistake
If I set a higher priority for voice traffic, I automatically give it more bandwidth.
Correct
Priority affects the order packets are sent, not the amount of bandwidth they receive. To give a traffic type more bandwidth, you must configure a guaranteed bandwidth setting.
Beginners confuse priority (which queue you get into) with bandwidth (how much data you can send). The two are different dimensions of QoS.
Mistake
Traffic shaping will fix a permanently overloaded internet connection.
Correct
Traffic shaping manages congestion but does not increase bandwidth. If a 100 Mbps link is consistently saturated with 150 Mbps of demand, shaping just decides which traffic gets dropped or delayed. The only real fix is to upgrade bandwidth.
People see QoS as a magic cure for slow internet. Shaping is about fairness and prioritisation, not creation of extra capacity.
Mistake
QoS only matters on the company firewall, not on internal switches.
Correct
QoS is implemented end-to-end. If your firewall shapes traffic nicely but the internal switch drops all high-priority packets because it does not trust the markings, the QoS policy fails. The FortiGate can mark DSCP values that switches can read and honour.
Beginners often think QoS is a single-device feature, not a chain of trust across the network path.
Mistake
Assigning a per-IP shaper to a whole subnet limits the total bandwidth of that subnet.
Correct
A per-IP shaper limits bandwidth for each individual IP address within the subnet. If you set a 1 Mbps per-IP shaper on a subnet with 50 devices, each device can use up to 1 Mbps, totalling 50 Mbps possible. To limit the whole subnet, you need a shared shaper.
The name 'per-IP' is misleading. Beginners assume it means 'per subnet' or 'per policy', but it literally means per single IP address.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
QoS is the overall concept of prioritising and managing network traffic. Traffic shaping is a specific technique used to enforce QoS, often by delaying or limiting certain traffic to prevent congestion.
Yes, even with high bandwidth, bursts of traffic can cause temporary congestion. QoS ensures that during these bursts, critical traffic like voice or video is not dropped or delayed.
You create a traffic shaper (shared or per-IP) under Policy & Objects > Traffic Shaping. Then, you attach that shaper to an existing firewall policy in the policy's traffic shaping settings.
A shared shaper limits the total bandwidth used by all traffic matching a policy (e.g., all YouTube traffic gets max 50 Mbps). A per-IP shaper limits bandwidth per individual IP address (e.g., each user gets max 5 Mbps).
It is the minimum amount of bandwidth that a specific traffic class is always entitled to, even if the link is congested. This prevents that class from being starved by other traffic.
Traffic shaping can slow down low-priority traffic during congestion, but it should not slow down your connection overall. It just makes sure important traffic gets through quickly by delaying or limiting less important traffic.
You've finished Traffic Shaping and Quality of Service (QoS). Continue through the NSE4 study guide to build a complete picture of the exam.
Done with this chapter?