# Traffic Shaping and Quality of Service (QoS)

> Chapter 15 of the Courseiva FORTINET-NSE4 curriculum — https://courseiva.com/learn/fortinet-nse4/traffic-shaping-and-qos

**Official objective:** 3.3 — Implement traffic shaping policies and QoS settings to prioritize and limit bandwidth for different types of traffic.

## Introduction

If you have ever tried to watch a video while your housemate is gaming and the video keeps buffering, you have experienced a network without Quality of Service. Traffic shaping and QoS are the tools that let an IT professional decide which internet traffic gets treated like a VIP and which can wait, so that important tasks like video calls or critical business data always get through.

## The Head Chef's Kitchen Analogy

A head chef runs a busy restaurant kitchen during Friday night dinner service. Orders come in constantly. The kitchen has limited stoves, ovens, and prep space. If the chef lets every order through at once, chaos erupts. Cooks bump into each other, ovens overheat, soufflés collapse, and customers wait forever or get cold food. The chef must decide which orders get priority. A VIP guest's steak gets fired immediately. A large table's multiple dishes get spaced out so they all arrive together. A simple salad gets delayed if the line is already slammed with searing steaks. This is traffic shaping. The head chef also practises quality of service by guaranteeing each table gets at least its bread basket within five minutes, ensuring no table is entirely ignored. The chef sets bandwidth limits: the fryer station can only handle ten baskets of chips at once. New orders for chips get queued or rejected. If the kitchen is drowning, the chef tells the front-of-house to stop taking new orders for a while. That is a traffic policy in action. The chef uses these rules so the restaurant survives the rush, customers leave happy, and the kitchen staff don't quit. Without this, the kitchen burns out, orders fail, and the restaurant gets terrible reviews. That is exactly what traffic shaping and QoS do for a computer network.

## Core explanation

Traffic shaping and Quality of Service (QoS) are techniques used on a network to manage data traffic so that important data gets priority and bandwidth is used efficiently. Think of a network as a highway. Without any rules, every car (data packet) competes for the same space, leading to jams and crashes. Traffic shaping and QoS are the traffic management system that keeps things moving.

First, let's define some key terms. A network is a group of computers and devices connected so they can share data. Bandwidth is the maximum amount of data that can travel over a network connection in a given amount of time, like the number of lanes on a highway. More bandwidth means more data can flow at once. A data packet is a small unit of data sent over a network. All data you send or receive is broken into packets.

QoS is a set of technologies that gives different types of traffic different levels of priority. It does not increase bandwidth. Instead, it makes sure that when the network gets busy, the most important data gets through first. Traffic shaping is one method used to implement QoS. It controls the volume of traffic being sent into the network and can delay some packets to prevent congestion.

Why does this exist? Before QoS, networks used a best-effort model. All packets were treated equally. If the network got congested, packets were dropped at random. This is fine for email or file downloads, but terrible for real-time applications like voice calls or video conferencing where a dropped packet means a garbled word or frozen image.

How does it work? Traffic shaping uses two main actions: prioritisation and rate limiting.

- Prioritisation: The network device (like a FortiGate firewall) looks at each packet and decides its priority based on rules. These rules can be based on the type of traffic (like voice or video), the source or destination address, or the application. High-priority traffic, like a VoIP call, gets a dedicated slot in the queue (the waiting line). Low-priority traffic, like a large file download, gets a less favourable slot.

- Rate limiting: This is the shaping part. You set a maximum speed for a certain type of traffic. If a user is downloading a huge file, you can limit that download to 1 Mbps, leaving the rest of the bandwidth free for other users. This prevents one application from soaking up all the available bandwidth.

Traffic shaping also uses buffers. A buffer is a temporary storage area for data packets. When too many packets arrive at once, the router holds some in a buffer instead of dropping them. This smooths out bursts of traffic. However, buffers have a limit. If they fill up, packets are dropped. This is called tail drop.

QoS can be implemented in several ways. One common method is class-based QoS. You create classes of traffic, such as "voice", "video", "business-critical", and "best-effort". You then assign a minimum guaranteed bandwidth to the higher classes (so voice always has enough) and a maximum limit on the lower classes (so best-effort traffic cannot starve the others).

Another method is using DiffServ (Differentiated Services). In this model, a device marks each packet with a specific value in its header (the packet's label). This value tells downstream routers how to treat that packet. This is like putting a VIP badge on a package in a postal service. Routers along the path see the badge and give it faster handling.

On a FortiGate firewall, you set up traffic shaping through policies. You create a traffic shaper that defines the maximum and guaranteed bandwidth for a type of traffic. Then you link that shaper to a firewall policy. When traffic matches that policy, it is shaped according to the shaper's rules. You can also use per-IP shapers to limit each individual user.

QoS replaces the old best-effort model with a structured, predictable system. It does not fix a network that is permanently overloaded, but it does make sure that during temporary congestion, the most important work gets done.

## Real-world context

Imagine you are an IT administrator for a mid-sized company called "GreenTech Ltd." The company has 200 employees who all use the internet for email, web browsing, and accessing cloud applications like Microsoft 365. The company also runs a real-time video surveillance system for the warehouse and uses VoIP phones for all customer calls.

The total internet bandwidth is a 200 Mbps fibre line. Without any traffic management, one employee watching 4K YouTube videos could saturate the link, causing everyone else's video calls to stutter and the warehouse cameras to lose frames. That is a disaster waiting to happen.

Here is what you, as the IT professional, actually do step by step:

1. Analyse the traffic: First, you log into the FortiGate firewall and look at the traffic logs. You identify the top bandwidth consumers. You see that employee Bob is streaming Netflix during lunch, and the automatic software updates from a few servers are using large chunks of bandwidth.

2. Define traffic classes: You create five classes of traffic:
- Class 1: Voice (VoIP calls, priority 5)
- Class 2: Video surveillance (priority 4)
- Class 3: Business applications (Microsoft 365, priority 3)
- Class 4: Web browsing and email (priority 2)
- Class 5: Everything else (streaming, downloads, priority 1)

3. Create traffic shapers on the FortiGate: You go to the Traffic Shaping section. For the Voice class, you create a shaper that guarantees 20 Mbps minimum and allows up to 50 Mbps. For Video surveillance, you guarantee 10 Mbps. For the 'Everything else' class, you set a hard limit of 10 Mbps total. This means that even if Bob tries to stream Netflix, he gets no more than 10 Mbps collectively with everyone else in that class, leaving 190 Mbps for the important traffic.

4. Apply the shapers to firewall policies: You configure your firewall policies. The policy that allows VoIP traffic gets the Voice shaper attached. The policy for web traffic gets the Web browsing shaper. The FortiGate now automatically enforces these rules every time a packet matches the policy.

5. Monitor and adjust: A month later, you check the bandwidth reports. You notice the Video surveillance class is almost hitting its 10 Mbps limit during peak times, but the Voice class rarely uses more than 10 Mbps. You adjust the Video surveillance shaper to 15 Mbps and lower the voice guarantee slightly. You also enable per-IP shaping for the 'Everything else' class, so each user is limited to 2 Mbps. Bob can still stream, but in low quality, and he does not affect anyone else.

This real-world implementation ensures that every customer call is crystal clear, the warehouse video feeds are smooth, and the employees can still browse the web and check email without frustration.

## Exam focus

The NSE4 exam (specifically exam objective 3.3) tests your ability to implement traffic shaping policies and QoS settings on a FortiGate firewall. You must understand the concepts, the FortiGate configuration, and common pitfalls.

What exactly does it test? Here is the breakdown of what to focus on:

- The difference between guaranteed bandwidth and maximum bandwidth: This is a crucial distinction. Guaranteed bandwidth is the amount of bandwidth the traffic is always entitled to, even if the link is congested. Maximum bandwidth is the upper limit the traffic can reach if the link has spare capacity. The exam loves to ask which setting prevents a class from starving other classes. The answer is guaranteed bandwidth. Memorise this.

- The two types of traffic shapers on FortiGate: Shared shaper and Per-IP shaper.
  - Shared shaper: Limits the total bandwidth used by a group of users or all traffic matching a policy. For example, shaping all YouTube traffic to 50 Mbps total.
  - Per-IP shaper: Limits bandwidth per individual IP address. For example, shaping each user to a maximum of 5 Mbps. The exam will ask which shaper to use to stop one user from hogging all bandwidth. The correct answer is Per-IP shaper.

- Traffic shaping policies vs firewall policies: You must know that a firewall policy is the main rule (allow/deny traffic), and traffic shaping is a secondary action attached to that policy. The exam will test the order of operations: traffic is first matched to a firewall policy, and then the attached shaper is applied.

- DiffServ marking and queueing: They may ask about Differentiated Services Code Point (DSCP) values. You do not need to memorise all DSCP values, but you need to know that marking traffic with a certain DSCP value allows routers downstream to prioritise it. FortiGate can mark or remark DSCP values.

- Traps and common mistakes:
  - Trap 1: Confusing bandwidth with priority. A high-priority queue does not automatically give more bandwidth. It gives better treatment when there is congestion. The exam may present a scenario where you need more bandwidth for voice but your QoS settings only guarantee priority. The correct fix is to increase the guaranteed bandwidth, not just the priority.
  - Trap 2: Shaping traffic that is already shaped upstream. If your ISP shapes traffic, applying additional shaping on your FortiGate may not help. They may ask about the best place to shape traffic (at the edge of your network).
  - Trap 3: Forgetting that traffic shaping policies are applied after the firewall policy. If a firewall policy denies traffic, no shaping happens. If a firewall policy allows traffic without a shaper attached, the traffic goes through unshaped.

- Key definitions to memorise:
  - QoS (Quality of Service): The overall ability to prioritise traffic.
  - Traffic shaping: The action of controlling traffic volume, often by delaying packets.
  - Bandwidth: Maximum data transfer rate.
  - Throughput: Actual data transfer rate over time.
  - Jitter: Variation in packet delay. QoS helps control jitter.
  - Latency: Delay a packet experiences. Shaping can increase latency for low-priority traffic.
  - Packet loss: When packets are dropped. QoS reduces packet loss for high-priority traffic.

- Exam question pattern: They often give a scenario (e.g., "A company has voice traffic and file downloads on the same link. Voice calls are dropping. What should you configure?") Expect multiple-choice answers that mix up shaper types, bandwidth vs priority, and DSCP vs queue. The correct answer usually involves creating a shared shaper with a guaranteed bandwidth for voice and a maximum bandwidth for downloads.

## Step by step

1. **Analyse current traffic patterns** — Use the FortiGate traffic logs or dashboard to identify which applications consume the most bandwidth and which are critical. This tells you what needs shaping and what your priorities should be.
2. **Define traffic classes and priorities** — Group traffic into categories like Voice, Video, Business Critical, and Best Effort. Assign each a priority level (higher number = higher priority). This is the conceptual blueprint for your QoS policy.
3. **Create shared traffic shapers for each class** — On the FortiGate, navigate to Policy & Objects > Traffic Shaping > Shaping Policy. Create a shaper for each class. For high-priority classes, set a guaranteed bandwidth. For low-priority classes, set a maximum bandwidth limit. This controls the bandwidth each class can use.
4. **Attach shapers to firewall policies** — Go to the firewall policy that matches the traffic (e.g., the policy allowing VoIP). In the policy settings, enable traffic shaping and select the corresponding shaper. Now the shaper is enforced whenever that traffic flows through the policy.
5. **Create per-IP shapers for user control** — If you want to stop individual users from hogging bandwidth, create a per-IP shaper. In a firewall policy that matches general user traffic, attach this per-IP shaper. Set the maximum bandwidth per IP (e.g., 2 Mbps). This ensures no single user can exceed that limit.
6. **Test and monitor results** — After applying the shapers, run tests. Simulate network congestion (e.g., start a large download while on a VoIP call). Check the FortiGate traffic reports to see if high-priority traffic is getting its guaranteed bandwidth. Adjust the guaranteed and maximum values if needed.

## Comparisons

### Guaranteed Bandwidth vs Maximum Bandwidth

**Guaranteed Bandwidth:**
- The minimum amount of bandwidth a traffic class is always entitled to.
- Even during congestion, this bandwidth is reserved and not taken by other traffic.
- Ensures critical applications (like voice) always have enough capacity.

**Maximum Bandwidth:**
- The upper limit a traffic class can use when the link has spare capacity.
- If reached, excess packets are delayed or dropped.
- Prevents one traffic class from using all available bandwidth.

### Shared Shaper vs Per-IP Shaper

**Shared Shaper:**
- Limits the total bandwidth used by all traffic matching a policy.
- Useful for shaping a whole category of traffic (e.g., all video streaming).
- Does not control individual user consumption within that category.

**Per-IP Shaper:**
- Limits bandwidth for each individual IP address.
- Prevents one user from monopolising the bandwidth.
- Applied using the 'per-ip' shaper option in FortiGate.

### Traffic Shaping vs Rate Limiting

**Traffic Shaping:**
- A broader concept that includes delaying or dropping packets to smooth traffic.
- Can use buffers to store packets and send them later.
- Aims to manage bandwidth allocation over time.

**Rate Limiting:**
- A stricter method that discards packets immediately when a threshold is exceeded.
- Often used for rate limiting per user or interface.
- Simpler but can cause more packet loss.

## Diagram

_This diagram shows how traffic enters the FortiGate, is matched to a firewall policy, has a traffic shaper applied (shared or per-IP), and then is scheduled into a priority queue before leaving the interface._

```mermaid
flowchart TD
    A[User traffic enters FortiGate] --> B{Firewall Policy Match}
    B -- Allowed with shaper --> C[Traffic Shaper applied]
    C --> D{Shaper type?}
    D -- Shared Shaper --> E[Limits total bandwidth for this traffic class]
    D -- Per-IP Shaper --> F[Limits bandwidth per individual IP]
    E --> G[Packet scheduled into priority queue]
    F --> G
    G --> H[Outbound to WAN or LAN]
    B -- Denied --> I[Packet dropped]
```

## Common misconceptions

- **Misconception:** If I set a higher priority for voice traffic, I automatically give it more bandwidth. **Reality:** Priority affects the order packets are sent, not the amount of bandwidth they receive. To give a traffic type more bandwidth, you must configure a guaranteed bandwidth setting. (Beginners confuse priority (which queue you get into) with bandwidth (how much data you can send). The two are different dimensions of QoS.)
- **Misconception:** Traffic shaping will fix a permanently overloaded internet connection. **Reality:** Traffic shaping manages congestion but does not increase bandwidth. If a 100 Mbps link is consistently saturated with 150 Mbps of demand, shaping just decides which traffic gets dropped or delayed. The only real fix is to upgrade bandwidth. (People see QoS as a magic cure for slow internet. Shaping is about fairness and prioritisation, not creation of extra capacity.)
- **Misconception:** QoS only matters on the company firewall, not on internal switches. **Reality:** QoS is implemented end-to-end. If your firewall shapes traffic nicely but the internal switch drops all high-priority packets because it does not trust the markings, the QoS policy fails. The FortiGate can mark DSCP values that switches can read and honour. (Beginners often think QoS is a single-device feature, not a chain of trust across the network path.)
- **Misconception:** Assigning a per-IP shaper to a whole subnet limits the total bandwidth of that subnet. **Reality:** A per-IP shaper limits bandwidth for each individual IP address within the subnet. If you set a 1 Mbps per-IP shaper on a subnet with 50 devices, each device can use up to 1 Mbps, totalling 50 Mbps possible. To limit the whole subnet, you need a shared shaper. (The name 'per-IP' is misleading. Beginners assume it means 'per subnet' or 'per policy', but it literally means per single IP address.)

## Key takeaways

- Traffic shaping does not create bandwidth; it prioritises how existing bandwidth is shared during congestion.
- A guaranteed bandwidth setting ensures a specific traffic type always gets at least that much capacity, even if the link is full.
- A per-IP shaper limits the bandwidth for each individual IP address, preventing one user from monopolising the connection.
- QoS and traffic shaping are applied as an action within a firewall policy, not as a standalone rule.
- You must configure traffic shaping on both sides of the network (LAN and WAN) or use DSCP markings for end-to-end effectiveness.
- Voice and video traffic benefits most from QoS because they are sensitive to jitter, latency, and packet loss.

## FAQ

**What is the difference between traffic shaping and QoS?**

QoS is the overall concept of prioritising and managing network traffic. Traffic shaping is a specific technique used to enforce QoS, often by delaying or limiting certain traffic to prevent congestion.

**Do I need QoS if I have plenty of internet bandwidth?**

Yes, even with high bandwidth, bursts of traffic can cause temporary congestion. QoS ensures that during these bursts, critical traffic like voice or video is not dropped or delayed.

**How do I configure traffic shaping on a FortiGate firewall?**

You create a traffic shaper (shared or per-IP) under Policy & Objects > Traffic Shaping. Then, you attach that shaper to an existing firewall policy in the policy's traffic shaping settings.

**What is a shared shaper versus a per-IP shaper?**

A shared shaper limits the total bandwidth used by all traffic matching a policy (e.g., all YouTube traffic gets max 50 Mbps). A per-IP shaper limits bandwidth per individual IP address (e.g., each user gets max 5 Mbps).

**What does 'guaranteed bandwidth' mean in traffic shaping?**

It is the minimum amount of bandwidth that a specific traffic class is always entitled to, even if the link is congested. This prevents that class from being starved by other traffic.

**Will traffic shaping slow down my internet?**

Traffic shaping can slow down low-priority traffic during congestion, but it should not slow down your connection overall. It just makes sure important traffic gets through quickly by delaying or limiting less important traffic.

## Check your understanding

1. **What is the primary purpose of a guaranteed bandwidth setting in a traffic shaper?**

   Answer: It ensures that a specific traffic class always has at least that amount of bandwidth available, even during congestion, so critical applications are not starved.

2. **A company wants to stop one employee from using all the internet bandwidth. Which type of traffic shaper should they use on the employee's firewall policy?**

   Answer: A per-IP shaper, because it limits bandwidth for each individual IP address, preventing any single user from exceeding the limit.

3. **On a FortiGate, where do you attach a traffic shaper to enforce it?**

   Answer: You attach the shaper to a firewall policy under the traffic shaping section of that policy.

4. **What is the difference between QoS and traffic shaping?**

   Answer: QoS is the overall strategy for prioritising traffic, while traffic shaping is a specific technique used to implement QoS, often by controlling bandwidth and delaying packets.

5. **If you configure a shared shaper with a maximum bandwidth of 10 Mbps for YouTube traffic, what happens when users try to stream more than 10 Mbps total of YouTube traffic?**

   Answer: Excess packets are either delayed (queued) or dropped, depending on the buffer configuration, preventing the aggregate YouTube traffic from exceeding 10 Mbps.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse4/traffic-shaping-and-qos