FortiGate Administration Guide - FirewallShop.com

Configuring firewall policies
Firewall Policy
To configure traffic shaping
1 Go to Firewall > Policy.
2 When you create a new policy or edit a policy, select the Traffic Shaping option.
3 Configure the following three options:
Guaranteed
Bandwidth
Maximum
Bandwidth
Traffic Priority
Use traffic shaping to guarantee the amount of bandwidth available
through the firewall for a policy. Guarantee bandwidth (in Kbytes) to
ensure there is enough bandwidth available for a high-priority service.
Be sure that the sum of all Guaranteed Bandwidth in all firewall policies
is significantly less than the bandwidth capacity of the interface.
Use traffic shaping to limit the amount of bandwidth available through
the firewall for a policy. Limit bandwidth to keep less important services
from using bandwidth needed for more important services.
Select High, Medium, or Low. Select Traffic Priority so the FortiGate unit
manages the relative priorities of different types of traffic. For example,
a policy for connecting to a secure web server needed to support
e-commerce traffic should be assigned a high traffic priority. Less
important services should be assigned a low priority. The firewall
provides bandwidth to low-priority connections only when bandwidth is
not needed for high-priority connections.
Be sure to enable traffic shaping on all firewall policies. If you do not
apply any traffic shaping rule to a policy, the policy is set to high priority
by default.
Distribute firewall policies over all three priority queues.
Note: If you set both guaranteed bandwidth and maximum bandwidth to 0 (zero),
the policy does not allow any traffic.
IPSec firewall policy options
When Action is set to IPSEC, the following options are available:
Figure 169:IPSEC encryption policy
VPN Tunnel
Allow Inbound
Allow outbound
Inbound NAT
Outbound NAT
Select the VPN tunnel name defined in the phase 1 configuration. The
specified tunnel will be subject to this firewall encryption policy.
Select to enable traffic from a dialup client or computers on the remote
private network to initiate the tunnel.
Select to enable traffic from computers on the local private network to
initiate the tunnel.
Select to translate the source IP addresses of inbound decrypted
packets into the IP address of the FortiGate interface to the local
private network.
Select in combination with a natip CLI value to translate the source
addresses of outbound cleartext packets into the IP address that you
specify. Do not select Outbound NAT unless you specify a natip
value through the CLI. When a natip value is specified, the source
addresses of outbound IP packets are replaced before the packets
are sent through the tunnel. For more information, see the “firewall”
chapter of the FortiGate CLI Reference.
FortiGate Version 3.0 MR5 Administration Guide
280 01-30005-0203-20070830