fortigate traffic shaping policy

[kinmun]

is it effective to make use of fortigate traffic shaping policy to control the Internet traffic in my environment to prevent my Internet pipe from getting congested?

i have about 120 users with Internet access at different sites but going through the same main corporate firewall for Internet access.

which method is effective in managing the Internet bandwidth through the fortigate.

I am using FortiIS 5.4.4

[ede_pfau]

TS in FOS is quite effective if

- hosts are using unique source addresses (no NAT of a whole subnet behind just one address)

- you can live with non-cooperative throttling

Background for the latter: suppose you have 100 Mbps WAN bandwidth, and 10 subnets sharing the WAN line. For fairness you limit each subnet's bw to 10 Mbps. Now, at night, there's 90 Mbps available - but one subnet cannot use it fully, only the assigned 10 Mbps. That's what I call 'non-cooperative'.

Additionally, TS for incoming traffic doesn't really work well. TS uses packet dropping only, TCP cares, UDP doesn't.

But then again, TS comes for free. Always comes in handy to throttle down that occasional leecher.

[kinmun]

how can i throttle down that occasional leecher 

[ede_pfau]

First you find out which source IP is most active (FortiView), then you create an address object for that address and finally you create a policy LAN->WAN, source <this_address>, with a traffic shaper. Put this policy on top of the general policy for the rest of the LAN hosts.