Edison,

Would this type of shaping work for anything that includes return traffic? Say I wanted to give 128k to a host for FTP traffic, but that was the max download I wanted them to have.

Theoretically, I could do:

access-list 101 permit ip host 192.168.1.50 any

class-map match-all RESTRICTED

match access-group 101

class-map match-all DSCP

match dscp 1

policy-map INSIDE

class RESTRICTED

set dscp 1

policy-map OUTSIDE

class DSCP

police 128000

int fa0/0 (outside)

ip address 5.15.23.33 255.255.255.0

ip nat outside

service-policy output OUTSIDE

int fa0/1 (inside)

ip address 192.168.1.1 255.255.255.0

ip nat inside

service-policy input INSIDE

ip nat inside sourc list 5 inter fa0/0 overload

access-list 5 permit ip 192.168.1.0 0.0.0.255

*This is all from memory*

I wanted to show where nat was, but the class-map and policy maps are the most important. I would mark everything coming into the inside interface, and then police on the outside? Would this work for stuff like FTP, bittorrent, p2p, etc?

Thanks!

John

Edison,

When you say that I needed to modify the acl to reflect ftp, p2p, etc, are you talking about tying it down to ports?

Should the acl look more like:

access-list 101 permit ip host 192.168.1.50 any eq 21

Thanks,

John

Yes, identifying the ports as 'ip' defines all ports.

No, the ACL would look like:

access-list 101 permit tcp host 192.168.1.50 any eq ftp

access-list 101 permit tcp host 192.168.1.50 any eq ftp-data

LOL! Yeah, that's what I meant. :)