let consider this example
data 192.168.1.0/24
internet 172.168.1.0/24
voice 10.1.1.0/24
on Site A
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 permit ip 172.16.1.0 0.0.0.255 any
access-list 102 permit ip 10.1.1.0 0.0.0.255 any
now let make class maps to match these ACLs
class-map data
match access-group 100
class-map internet
match access-group 101
class-map voice
match access-group 102
now lets make a policy for bandwdith management
plicy-map data
class data
police 100000 8000 exceed-action drop
plicy-map internet
class internet
police 100000 8000 exceed-action drop
now we gonna apply these polices on the inbound direction on the source ports not the uplink between switchs
so lets say the port that connected to data is fa0/1
and the port connected to internet is
fa0/5
this is on site A
interface fa0/1
service-policy input data
interface fa0/5
service-policy input internet
and leave the voice port wiout limitation
based on this config the traffic will be droped even befor it enter the switch f its above 100M
and the same idea on the site B
and if u want the communication be isolated between VLANs on L2 make the linke between the swithes as trunk and dont make SVIs to avoid routing between VLANs unless u make the routing with filtering
and keep the vlans span the upling as L2 vlans
and about the above ACLs if u have more subnest u can added to the ACLs eachwith it own class like data or internet
good luck
if helpful Rate
