3.5 Application Control & Traffic Shaping
Key Takeaways
- Application Control performs Layer 7 deep packet inspection to identify network applications regardless of port, protocol, or evasion techniques.
- FortiGuard Application Control signatures rate applications across Risk Levels 1 (lowest) to 5 (critical security risk).
- Application Overrides and Custom Application Signatures allow administrators to define detection rules for proprietary corporate applications.
- Traffic Shaping controls bandwidth allocation by prioritizing critical business applications and rate-limiting non-essential traffic.
- Shared Shapers enforce an aggregate bandwidth limit across all matching sessions, whereas Per-IP Shapers apply bandwidth limits individually to each client IP.
3.5 Application Control & Traffic Shaping
Modern network applications frequently obscure their identity by utilizing non-standard ports, tunneling over standard HTTP/HTTPS protocols, or employing evasive encryption. FortiOS Application Control provides Layer 7 visibility and control, while Traffic Shaping enforces bandwidth management policy based on identified application traffic.
Application Control Engine Architecture
Application Control operates using the FortiOS Layer 7 inspection engine. Unlike standard firewall rules that match traffic based on Layer 3 IP addresses and Layer 4 TCP/UDP ports, Application Control examines application payload signatures.
- Port-Independent Detection: Identifies applications regardless of the destination port. For example, if a user runs BitTorrent over TCP port 443 (traditionally reserved for HTTPS), Application Control detects the BitTorrent protocol header and enforces policy.
- Signature Database: Updated continuously via FortiGuard. Signatures cover thousands of cloud services, social media platforms, P2P networks, gaming protocols, and remote management tools.
Application Categories & Risk Ratings
FortiGuard groups applications into functional categories (such as P2P, Social.Media, Video/Audio, Game, Collaboration, Proxy) and assigns each application a Risk Rating from 1 to 5:
- Risk 1 (Very Low): Core infrastructure (NTP, DNS, ICMP).
- Risk 2 (Low): Enterprise SaaS (Microsoft 365, Salesforce).
- Risk 3 (Medium): Web browsing, general social tools.
- Risk 4 (High): Streaming media, personal cloud storage.
- Risk 5 (Critical): P2P file sharing, anonymizing proxies, unencrypted remote access tools.
Application Profiles & Custom Signatures
Within an Application Control profile (configured via config application list), administrators define actions per application category, specific application override rules, or risk level thresholds.
Actions
pass/allow: Permits the application traffic.block: Drops the application session.reset: Sends a TCP Reset packet to terminate the application connection.monitor: Allows the application while generating detailed application logs.
Custom Application Signatures
For internal, proprietary enterprise applications not present in the public FortiGuard database, administrators can construct Custom Application Signatures using pattern matching syntax targeting specific TCP/UDP port ranges, HTTP request headers, or payload hex strings.
Traffic Shaping (Bandwidth Management)
Traffic Shaping manages network congestion by enforcing quality of service (QoS), guaranteeing bandwidth for business-critical applications (such as VoIP or ERP), and capping bandwidth for non-essential traffic.
1. Types of Traffic Shapers
FortiOS supports two primary traffic shaper modes:
- Shared Shaper: Enforces a single aggregate bandwidth pool shared among all matching traffic flows across the firewall. If a Shared Shaper is set to 10 Mbps maximum bandwidth, all clients matching the rule combined cannot exceed 10 Mbps.
- Per-IP Shaper: Enforces the configured bandwidth limits independently on each individual source IP address. If a Per-IP Shaper is set to 2 Mbps maximum bandwidth, every individual host IP matching the policy gets up to 2 Mbps of throughput.
| Shaper Type | Operational Limit Mechanics | Best Use Case |
|---|---|---|
| Shared Shaper | Aggregate bandwidth cap across all active sessions combined. | Protecting total WAN interface bandwidth. |
| Per-IP Shaper | Individual bandwidth cap applied independently per client host IP. | Preventing a single host from abusing bandwidth. |
2. Shaper Parameters & Priority Queues
- Guaranteed Bandwidth: Minimum reserved bandwidth allocated to matching traffic even during network congestion.
- Maximum Bandwidth: Hard ceiling cap on maximum allowed bandwidth consumption.
- Traffic Priority: Defines priority queue scheduling (
High,Medium,Low). High-priority traffic is serviced first by the interface queue scheduler.
3. Traffic Shaping Policies
Traffic Shaping Policies (config firewall shaping-policy) link traffic shapers to specific security parameters: Source/Destination interfaces, Source/Destination IP addresses, Services, and Application Categories or specific Applications.
Overview Comparison
| Traffic Control Component | Primary Scope | Core Function | Typical Configuration |
|---|---|---|---|
| Application Profile | Layer 7 Payload | Block, allow, or monitor app protocols | config application list |
| Custom App Signature | Proprietary Payload | Identify internal custom apps | config application custom |
| Shared Shaper | Aggregate Bandwidth Pool | Protect total WAN pipe capacity | config firewall traffic-shaper |
| Per-IP Shaper | Per-Host Bandwidth Cap | Prevent single host bandwidth hogging | config firewall traffic-shaper |
| Shaping Policy | Policy Enforcement Mapping | Bind shapers to App categories & IPs | config firewall shaping-policy |
CLI Configuration Examples
Configuring an Application Control Profile
config application list
edit "Corp_App_Control"
set comment "Block P2P and critical risk apps, monitor social media"
config entries
edit 1
set category 2
set action block
next
edit 2
set risk 5
set action block
next
edit 3
set category 15
set action monitor
next
end
next
end
Configuring Shared and Per-IP Traffic Shapers
config firewall traffic-shaper
edit "Shared_WAN_Limit_10M"
set maximum-bandwidth 10000
set guaranteed-bandwidth 2000
set priority medium
next
edit "Per_IP_Cap_2M"
set per-ip enable
set maximum-bandwidth 2000
next
end
Configuring a Traffic Shaping Policy for Streaming Applications
config firewall shaping-policy
edit 1
set name "Limit_Streaming_Per_IP"
set srcintf "port2"
set dstintf "port1"
set srcaddr "Corp_LAN_Subnet"
set dstaddr "all"
set service "ALL"
set app-category 15
set per-ip-shaper "Per_IP_Cap_2M"
set schedule "always"
next
end
What is the primary operational distinction between a Shared Traffic Shaper and a Per-IP Traffic Shaper in FortiOS?
How does FortiGate Application Control identify encrypted or evasive applications running on non-standard ports (e.g. BitTorrent on TCP port 443)?
Which Application Control risk rating represents the highest security risk applications (such as remote control software or unencrypted P2P tools) in FortiOS?