FortiGate bandwidth management for video networks and branches
a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}
What FortiGate bandwidth management actually controls
FortiGate bandwidth management does not turn a slow circuit into a fast one. In FortiOS, it usually means applying traffic shaping policies, shared shapers, reverse shapers, per-IP shapers, shaping classes, DSCP marking and, in some deployments, SD-WAN QoS in a disciplined way. For video networks, the purpose is to stop camera streams, VMS access, NVR replication, operator workstations, cloud backup jobs and normal business applications from competing blindly for the same WAN, VPN or internet circuit. A useful design starts with traffic intent: which flows must be protected, which flows can be capped, and which flows should wait when congestion appears.
That distinction is important because bandwidth shaping is not the same as surveillance system design. It can protect a constrained path, but it cannot fix an undersized encoder setting, a congested access switch, a misrouted camera VLAN or a storage bottleneck. The FortiGate can only shape traffic that passes through it, so the first question is whether the video flow crosses the firewall, SD-WAN edge, VPN tunnel or routed interface.
Why video management traffic needs a different plan
Video traffic does not behave like ordinary web browsing. A user opening a website creates short bursts. A camera stream may run continuously for hours or days. A remote investigator reviewing recorded video can create heavy downstream demand for a limited period. A cloud archive job may run after business hours, but it can still compete with updates, backups, VoIP and point-of-sale applications if it is not controlled.
In a video management environment, the largest traffic sources are usually predictable: cameras to recorders, recorders to viewers, VMS servers to storage, and remote access through VPN or published services. The issue is not only total bandwidth consumption. Timing also matters. If a backup task saturates an uplink when an operator needs live multi-camera viewing, the operational impact can be immediate even when the average daily bandwidth graph looks acceptable.
A practical bandwidth plan separates four traffic groups. The first is real-time monitoring traffic that supports live response. The second is recording and replication traffic that must complete but may tolerate scheduling or caps. The third is administrative traffic, such as software updates and camera maintenance. The fourth is non-video traffic, such as guest Wi-Fi, web browsing or bulk downloads, that should not interfere with security operations.
Core FortiGate controls to understand
Fortinet documentation describes traffic shaping policies as the preferred modern way to map matched traffic to shapers or shaping classes. The older approach of applying shapers directly to firewall policies still exists in some contexts, but it can become difficult to manage as the number of firewall policies grows. In practice, the shaping policy should be treated as its own control layer: the firewall policy decides whether traffic is allowed, and the shaping policy decides how matched traffic is handled for bandwidth and priority.
| Control | What it does | Where it helps in video networks | Important limitation |
|---|---|---|---|
| Traffic shaping policy | Matches traffic by criteria such as interface, source, destination, service, user, application or traffic type, then applies a shaper or class. | Separating VMS remote viewing, NVR replication, guest traffic and ordinary business applications. | Policy order matters. A broad rule above a specific video rule can produce unexpected results. |
| Shared shaper | Applies a bandwidth limit, guarantee and priority to traffic using that shaper. | Setting an aggregate ceiling for non-critical traffic or reserving capacity for a known service class. | The limit is shared by all matching traffic unless configured per policy where supported. |
| Reverse shaper | Applies shaping in the return direction of a policy. | Controlling download-heavy flows such as remote playback from a VMS or file retrieval from a recorder. | Many failed designs shape only the upload direction and leave the download path uncontrolled. |
| Per-IP shaper | Limits bandwidth for each individual IP address and can also define session-related limits in current FortiOS documentation. | Preventing one workstation, guest device or branch user from consuming the full circuit. | If another device performs source NAT before the FortiGate sees the traffic, many users may appear as one IP. |
| Shaping class and profile | Assigns matched traffic to classes that are prioritized within an interface-based shaping profile. | Building a structured QoS model for voice, live video, business apps and bulk traffic. | Requires careful interface bandwidth assumptions; wrong values can distort the queueing design. |
| DSCP marking | Marks packets so downstream devices can recognize a traffic class. | Extending QoS intent beyond the firewall into switches, WAN routers or provider networks that honor markings. | Marking alone does not guarantee treatment unless the next devices trust and act on it. |
A practical design workflow
Start with the physical and logical path. If cameras and the recorder are on the same switch and do not cross the FortiGate, firewall shaping will not affect that camera-to-recorder stream. If cameras are in a segmented VLAN and must route through the FortiGate to reach a VMS, shaping may apply. If branch sites send video to a data center across IPsec or SD-WAN, the FortiGate is often central to the bandwidth plan.
- Measure the real link, not the brochure number. Use observed throughput, carrier commitments and VPN overhead when estimating available bandwidth. A 100 Mbps circuit rarely means every application should be allowed to plan for 100 Mbps at the same time.
- Classify video flows by operational value. Live response viewing, alarm verification and health monitoring may deserve stronger protection than overnight export jobs or archive synchronization.
- Separate upload and download assumptions. A branch that sends camera streams to a central recorder is upload-heavy. A headquarters user reviewing branch recordings may create download pressure in the opposite direction.
- Use shared shapers for aggregate behavior. A shared limit is useful when a group of flows should stay below a ceiling, such as cloud backup, guest Wi-Fi or non-critical downloads.
- Use per-IP shaping where fairness matters. Per-IP shaping is often useful for users, workstations or guest networks. It is less suitable when one VMS server legitimately needs more bandwidth than an ordinary endpoint.
- Put specific rules before broad rules. A policy for VMS replication or operator viewing should be evaluated before a general rule for all internet or all LAN-to-WAN traffic.
- Test during realistic congestion. A shaping rule that appears idle on a quiet afternoon may behave very differently during a camera firmware update, investigation export or multi-view monitoring session.
The most common planning error is treating every video packet as equally urgent. In reality, live alarm verification may be time-sensitive, while a scheduled archive transfer may simply need to finish before morning. FortiGate bandwidth management works best when those differences are reflected in policy.
Example policy ideas for video and branch environments
The following examples are conceptual design patterns, not a universal configuration. Interface names, FortiOS version, inspection mode, SD-WAN design and organizational risk tolerance can change the exact implementation.
| Use case | Likely match criteria | Shaping decision | Reason |
|---|---|---|---|
| Remote operator viewing a VMS | VMS server address, VPN users, VMS service ports or application identity where available. | Protect with priority or a reasonable guaranteed allocation; consider reverse shaping for heavy playback direction. | Operators need usable video during incidents, but playback can still be capped to protect the link. |
| Branch recorder sending scheduled archive data | Recorder IP, destination storage or backup service, scheduled time window. | Apply a maximum bandwidth limit and run during lower-use hours. | The transfer is important but usually less time-sensitive than live monitoring. |
| Guest Wi-Fi at a site with cameras | Guest VLAN, user group or wireless subnet. | Use per-IP shaping plus an aggregate shared cap. | Guest devices should not starve security, payment, voice or management traffic. |
| Camera firmware updates | Camera management VLAN, update server, administrative schedule. | Cap and schedule; avoid running updates across many cameras during business-critical monitoring periods. | Update traffic can create bursts that are unrelated to live surveillance needs. |
| Cloud viewing or mobile app access | VMS gateway, cloud connector or outbound service category if identifiable. | Allow enough bandwidth for expected viewers, but cap uncontrolled bulk export. | Cloud access can be useful, but unmanaged export can compete with local operations. |
For many sites, the cleanest first win is not a complex QoS hierarchy. It is a small set of clear rules: protect live operational traffic, cap guest and bulk traffic, schedule known heavy jobs, and verify that both download and upload directions are covered.
Monitoring, troubleshooting and version checks
Bandwidth management should be validated with evidence. A policy can look correct in the interface and still fail to affect the intended flow because the traffic does not match the rule, the direction is wrong, another policy catches it first, or NAT changes the visible source address.
- Confirm the firewall policy match first. FortiGate traffic must be accepted by the relevant firewall policy before a shaping policy can produce the intended result.
- Check shaping policy order. Place narrow, high-value video rules before broad catch-all policies.
- Verify direction. Shared shaping follows the policy direction; reverse shaping is used for the opposite direction. This is especially important for download-heavy VMS playback.
- Watch for upstream NAT. Per-IP shaping depends on the FortiGate seeing individual IP addresses. If traffic arrives already source-NATed, per-user fairness may collapse into one visible address.
- Do not rely on one dashboard only. Fortinet documentation has noted that some FortiView views may not include every shaper type, such as reverse or per-IP shapers, depending on context and version. Use logs, session inspection and controlled tests when validating behavior.
- Check release notes for the exact model and FortiOS branch. Hardware acceleration, NP processor behavior and FortiOS release changes can affect how shaping, policing and queueing are implemented.
For production changes, document the expected result before enabling the rule. For example: guest users should not exceed a defined per-IP rate; VMS playback should remain usable during a backup; archive replication should not consume more than a defined share of the branch uplink. This makes testing clearer and helps future administrators understand why the policy exists. See also: Access Control.
Security and operational cautions
Traffic shaping is not a substitute for network segmentation. Cameras, VMS servers, recorders and management workstations should still be separated by VLANs and firewall policies that reflect the least access required. Bandwidth controls can reduce congestion, but they do not decide whether a camera should be allowed to communicate with an unrelated server.
Be careful with aggressive caps on security systems. If a maximum bandwidth value is too low, it can cause dropped frames, delayed playback, failed exports or unreliable remote viewing. A better approach is to protect critical video paths and cap lower-priority traffic first. When video bandwidth must be reduced, start with encoder settings, stream selection, recording schedules and viewer behavior rather than throttling all surveillance traffic at the firewall.
Finally, review the plan after operational changes. Adding cameras, increasing resolution, enabling more remote viewers, moving storage to the cloud or changing VPN topology can invalidate old assumptions. FortiGate bandwidth management should be treated as a living policy set tied to the actual video architecture.
Frequently asked questions
Can FortiGate limit bandwidth per user or per device?
Yes. Per-IP traffic shaping is designed to limit the bandwidth available to each visible IP address, and current FortiOS documentation also describes session-related controls for per-IP shapers. It works best when the FortiGate can see each endpoint address. If another device performs NAT before the FortiGate, multiple users may appear as one source IP.
How do I limit download bandwidth on a FortiGate?
In FortiGate traffic shaping, download control often requires a reverse shaper because the normal shared shaper applies in the policy direction. If a LAN-to-WAN policy is used, the shared shaper affects outbound flow, while the reverse shaper affects return traffic. This direction detail is a common reason bandwidth rules appear not to work.
Should video traffic always get the highest priority?
No. Some video traffic is operationally urgent, such as live alarm verification. Other traffic, such as scheduled archive transfer, may tolerate delay. A better model is to classify video flows by purpose and time sensitivity instead of assigning every camera-related packet the same priority.
Will FortiGate shaping improve camera quality?
It can protect bandwidth on a congested routed path, but it cannot create capacity that does not exist. Camera quality also depends on bitrate, codec settings, frame rate, resolution, packet loss, latency, switching capacity, storage performance and VMS configuration.
When is FortiGate bandwidth management most useful for video management?
It is most useful when video crosses a constrained firewall-controlled path, such as a branch WAN, VPN tunnel, SD-WAN edge, inter-VLAN route or internet connection. It is less relevant for camera traffic that stays entirely inside the same local switching segment and never passes through the FortiGate.
