How to Set a downlink speed limit on a vro

Some time ago, some customers asked me if I could limit the downlink speed of some internal machines. I naturally replied: I can limit the speed. In fact, the speed limit is certainly acceptable, but a specific problem needs to be considered.

Generally, the Access Router performs address translation, but the following steps are displayed when you understand the operation steps of the router:

Check input rate limits -------> nat outside to inside -------> check output rate limits

Therefore, the speed limit policy must be applied to some internal hosts. Because the inside local address must be specified in the ACL, service-policy output xxx should be applied to the Intranet interface, instead of the service-policy input xxx on the Internet interface!

The following is a specific example:

Router#sh run Building configuration... Current configuration : 1026 bytes ! version 12.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! ! ip subnet-zero ! ! no ip domain lookup ! ! class-map match-all test-class match access-group 100 ! ! policy-map speed class test-class police cir 80000 bc 32000 conform-action transmit exceed-action drop ! ! ! ! ! interface FastEthernet0/0 ip address 192.168.1.111 255.255.255.0 ip nat outside duplex auto speed auto ! interface FastEthernet0/1 ip address 172.16.1.1 255.255.255.0 ip nat inside duplex auto speed auto service-policy output speed ! ip nat inside source list 1 interface FastEthernet0/0 overload ! ip classless ip route 0.0.0.0 0.0.0.0 192.168.1.1 no ip http server ! ! access-list 1 permit any access-list 100 deny ip any host 172.16.1.100 access-list 100 permit ip any any ! line con 0 line aux 0 line vty 0 4 ! ! end