Enabling Quality of Service (QoS) on a FortiGate Firewall for VoIP
← Network & Firewall
Enabling Quality of Service (QoS) on a FortiGate Firewall for VoIP
Section titled “Enabling Quality of Service (QoS) on a FortiGate Firewall for VoIP”QoS (Quality of Service) ensures that VoIP traffic is prioritized over lower-priority traffic such as file downloads or streaming video. Without QoS, bandwidth saturation can cause choppy audio, jitter, and dropped calls — even when total bandwidth appears sufficient.
This guide covers enabling QoS for SIP VoIP traffic on FortiGate firewalls.
Step 1: Log into the FortiGate Web Interface
Section titled “Step 1: Log into the FortiGate Web Interface”- Open a browser and navigate to your FortiGate management IP.
- Log in with administrator credentials.
Step 2: Create a Traffic Shaper for VoIP
Section titled “Step 2: Create a Traffic Shaper for VoIP”Traffic shapers define bandwidth limits and priorities for specific traffic classes.
- Navigate to Policy & Objects → Traffic Shapers.
- Click Create New.
- Configure:
| Setting | Value |
|---|---|
| Name | VoIP-Priority |
| Type | Shared |
| Traffic Priority | High |
| Maximum Bandwidth | Set based on your available upload bandwidth |
| Guaranteed Bandwidth | Reserve bandwidth for expected concurrent calls |
| DSCP Marking | Enabled — set to EF (Expedited Forwarding, DSCP 46) |
- Click OK to save.
Step 3: Create a Traffic Shaping Policy
Section titled “Step 3: Create a Traffic Shaping Policy”- Navigate to Policy & Objects → Traffic Shaping Policy.
- Click Create New.
- Configure the match criteria:
| Setting | Value |
|---|---|
| Source | Internal LAN address or VoIP device group |
| Destination | all (or SIPSTACK IP subnets if known) |
| Service | SIP (port 5060) and ALL for RTP (10000–65535 UDP) |
| Application Shaper | VoIP-Priority (created above) |
| Reverse Shaper | VoIP-Priority (for inbound audio) |
- Place this policy above any general internet shaping policies in the list.
- Click OK.
Step 4: Apply QoS to the Firewall Policy
Section titled “Step 4: Apply QoS to the Firewall Policy”- Navigate to Policy & Objects → IPv4 Policy (or IPv6 as appropriate).
- Edit the policy governing VoIP traffic (typically LAN → WAN).
- Under Security Profiles, ensure the traffic shaping profile is enabled.
- Save the policy.
Step 5: Verify QoS is Working
Section titled “Step 5: Verify QoS is Working”- Navigate to Dashboard → Network and observe traffic graphs during a test call.
- Or use FortiView → Traffic to inspect per-application bandwidth usage.
- Under Monitor → Traffic Shaping Monitor, confirm the VoIP class is showing traffic with expected priority.
DSCP Reference
Section titled “DSCP Reference”| DSCP Class | Hex | Decimal | Use Case |
|---|---|---|---|
| EF (Expedited Forwarding) | 0x2E | 46 | VoIP audio — highest priority |
| AF41 | 0x22 | 34 | VoIP signaling (SIP) |
| BE (Best Effort) | 0x00 | 0 | General internet traffic |