Create and Apply Traffic Shaping Queues on a FortiGate (FortiOS 7.x)

Before you run this

This guide builds interface-based traffic shaping on a FortiGate: you define traffic classes (the "queues"), group them into a shaping profile that gives each class a guaranteed floor and a maximum ceiling of the link's bandwidth, apply that profile to an egress interface, then steer traffic into the right class with a shaping policy. The purpose is simple QoS — keep latency-sensitive traffic (VoIP, for example) from being drowned out by bulk downloads.

What you need and what to watch for:

• Privileges: a super_admin account, or an admin profile with read-write access to Firewall and System. You will work in the FortiGate CLI (SSH or console) and/or the GUI. Nothing here is "unprivileged" — these commands change production forwarding behaviour.
• This changes live traffic. The moment you attach a shaping profile to an interface, every flow leaving that interface is subject to the classes you defined. A bad guaranteed-bandwidth value, or a default class that's too small, can starve production traffic even though no interface goes down. Read each block before you paste it.
• Keep an out-of-band path open. Have a console cable or a management connection that does not egress the interface you're shaping. If a policy misclassifies management traffic, you want a way back in.
• Back up first. GUI: System → Configuration → Backup. CLI: execute backup config (check the admin guide for the destination keyword — tftp, usb, etc.). On models with local revision support you can also use System → Configuration → Revisions to snapshot before changing.
• Do it in a maintenance window, and test on a lab box or a FortiGate-VM first. These settings are fully reversible (remove the profile from the interface, delete the policy and objects, or restore the backup / revert the revision), but you don't want to discover a misconfiguration during peak hours.

Assumptions for this guide: FortiOS 7.4, a single-VDOM (or no-VDOM) FortiGate, WAN on wan1, LAN on internal or port2. Substitute your own interface names and bandwidth figures where shown.

How the pieces fit

Interface-based shaping has four parts, built in this order:

1. Traffic classes — numbered buckets with names (config firewall traffic-class).
2. Shaping profile — maps each class to a share of the interface bandwidth (config firewall shaping-profile).
3. Interface bandwidth + profile attachment — percentages are meaningless until the interface knows its total bandwidth (set outbandwidth) and has the profile applied.
4. Shaping policy — decides which traffic lands in which class (config firewall shaping-policy).

Shared and per-IP traffic shapers (config firewall shaper ...) are the other common approach and are fine for simple "cap this app to X Mbit" jobs. This guide uses the profile/class model because that's what gives you prioritised queues on an interface.

Step 1 — Define the traffic classes

Class IDs are integers you'll reference everywhere else. Give each a readable name.

config firewall traffic-class
    edit 2
        set class-name "voice"
    next
    edit 3
        set class-name "business"
    next
    edit 4
        set class-name "bulk"
    next
end

I start at ID 2 because low IDs can be reserved — confirm the valid range for your model in the FortiOS CLI reference rather than assuming 0 or 1 are free.

Step 2 — Build the shaping profile

Each entry ties a class to a guaranteed percentage (its floor, always available to that class) and a maximum percentage (its ceiling, which it can burst to if the link is idle). Percentages are of the interface's configured bandwidth, which you set in Step 3.

config firewall shaping-profile
    edit "wan-egress-qos"
        set default-class-id 3                 # traffic not matched by a policy lands here
        config shaping-entries
            edit 1
                set class-id 2                  # voice
                set guaranteed-bandwidth-percentage 20
                set maximum-bandwidth-percentage 100
            next
            edit 2
                set class-id 3                  # business (the default)
                set guaranteed-bandwidth-percentage 40
                set maximum-bandwidth-percentage 100
            next
            edit 3
                set class-id 4                  # bulk
                set guaranteed-bandwidth-percentage 10
                set maximum-bandwidth-percentage 60
            next
        end
    next
end

A priority field (set priority ...) also exists on each entry and controls which class wins contention beyond its guarantee. The accepted priority keywords differ between releases, so rather than guess, run set priority ? inside the entry on your own box to see the valid values before committing to it.

Keep the sum of your guaranteed percentages comfortably under 100 — those floors are reserved whether or not the class is using them.

Step 3 — Tell the interface its bandwidth and attach the profile

The profile's percentages need a real number to work from. Set outbandwidth in kbit/s to match your actual egress link (e.g. a 100 Mbit uplink = 100000).

config system interface
    edit "wan1"
        set outbandwidth 100000                # 100 Mbit/s egress, in kbit/s
        set egress-shaping-profile "wan-egress-qos"
    next
end

Egress shaping is the mainstream, well-understood case and is what I'd deploy. FortiOS also exposes inbound shaping (inbandwidth and an ingress shaping profile) — if you need to shape traffic arriving on the interface, confirm the exact ingress keyword and its caveats in the FortiOS Traffic Shaping admin guide before using it, as ingress policing behaves differently from egress queueing.

Step 4 — Steer traffic into classes with a shaping policy

A shaping policy matches on source/destination/service like a firewall policy but assigns a class-id instead of permitting or denying. It must reference the same interfaces your traffic actually uses.

config firewall shaping-policy
    edit 0                                      # 0 = auto-assign next ID
        set name "voice-to-voice-class"
        set service "SIP" "RTP"                 # use the service objects that exist on your box
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set class-id 2                          # -> voice class
    next
end

Add more entries for your business and bulk classes the same way. Anything not matched by a shaping policy falls into the profile's default-class-id (class 3 here). Confirm the service object names (SIP, RTP, etc.) exist — some are built in, some you may need to create under Policy & Objects → Services.

GUI equivalent

If you'd rather point and click: Policy & Objects → Traffic Shaping holds the Traffic Shaping Profile and Traffic Shaping Policy tabs. Create the profile and its classes there, attach the profile under Network → Interfaces on the chosen interface (set the egress/outbandwidth value there too), then build the shaping policy. The fields map one-to-one to the CLI above.

Verify it worked

First, confirm the objects and attachment are in place:

show firewall traffic-class
show firewall shaping-profile
show firewall shaping-policy
get system interface wan1 | grep -i shaping     # confirm the profile is bound

Then watch it under load. Generate some traffic and check live counters. For shared traffic shapers the standard tool is:

diagnose firewall shaper traffic-shaper list

For the interface/profile queues, use the FortiGate's own monitoring — FortiView / Dashboard → Traffic shaping in the GUI shows per-class throughput, drops, and whether a class is hitting its ceiling. If a class never reaches its guarantee under contention, revisit your percentages. Confirm your VoIP (or whatever you prioritised) holds latency while you saturate the bulk class.

Undo / rollback

Everything here is reversible. To back it out cleanly, remove in reverse order:

config system interface
    edit "wan1"
        unset egress-shaping-profile
    next
end

config firewall shaping-policy
    delete <policy-id>
end

config firewall shaping-profile
    delete "wan-egress-qos"
end

config firewall traffic-class
    delete 4
    delete 3
    delete 2
end

You cannot delete a profile that's still attached to an interface, or a class still referenced by a profile — that ordering matters. If anything behaves unexpectedly, the fastest clean recovery is to restore the pre-change backup (System → Configuration → Backup/Restore) or revert the revision you took in the safety step. That's exactly what the pre-change backup is for.

For the exact CLI reference on firewall shaping-profile, firewall shaping-policy, and the interface shaping fields in your build, see the FortiOS 7.4 CLI Reference and the Traffic Shaping chapter of the FortiOS Administration Guide on the Fortinet Document Library.