You can do tis on either the L3 switch, PIX (v 7.0 +) and Ur Internet router.

On the L3 switch this can be done on the L3 link connecting to the firewall. On the PIX inside interface if ios version is greater than or equal to 7.0, and on the internet router Inside interface if you are no doing NAT on the PIX and doing it on the router.

For doing this u need to write down access-lits differnetiating the server and proxy etc.

then u need to create class-map and match the access-lists into them, create policy-maps and intergrate the classes into them and finally bind it to the interface using a service policy.

I can provide the detail config which i have to spend some time, but i suggest you to do some reading w.r.t "Policing (QOS)" in order to understand what ur are doing so that u can handle any issues that might occur later.

All the best.

Please note that inbound and outbound traffic need diferent policies.

I wrote this post some weeks ago for inbound traffic:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cd34c23/3#selected_message

You need one external address for each policy.

Guido.

Please rate all the helpful comments.