Bandwidth limiting by vlan

Agree, you need QoS on the WAN links.

CoS or VLAN priority will not be sufficient.

On Cisco equipment supporting QoS, depending on how you want to go about doing it there are basically 4 steps involved for each link on which QoS is to be configured.

Understand you need to read up on the different types of QoS and queuing available.      Just plain traffic shaping may actually go far in this scenario.

The basic config steps which are taken on your WAN router generally involve

(1) Define "class-maps";   for classifying traffic
class-maps utilize "match"  statements to indicate what type of  traffic is part of that class.

You can match traffic packets by using interface names, Access lists, or NBAR (match protocol xxxxx), and there are other options  such as matching on ToS or IP precedence fields of packets.

E.g.
class-map match-any  staff-traffic
   match input-interface  FastEthernet0/0.123
   match access-group  staff-priority-traffic
class-map match-all   tenant-traffic
   match access-group tenant-priority-traffic
class-map match-all   management-traffic
   match  access-group    acl-management
   match protocol ssh
ip access-list extended management-traffic
   permit ip host 1.2.3.4  any
ip access-list extended staff-priority-traffic
   permit ip any any eq 80
ip access-list extended tenant-priority-traffic
   permit ip any any eq 80


(2)   Define a policy-map that utilizes the class maps  to either set ToS bits or IP precedence  (for another device to implement QoS decisions),  or  that utilizes class maps to place the traffic into some type of queue.

You might define different policy maps for handling inbound VS outbound traffic.
Policy maps REFER  to some class-maps,  and when traffic falls into a certain class,  the rules under the "class"  entry are used to  set aside bandwidth, or take various actions.

The first entry that matches is used.


An example utilizing class-based queuing (CBQ):
* Make sure your equipment properly knows how much bandwidth is available in 'show int',  and that you don't allocate more than 80% of the link to queues.

policy-map  library-wan-traffic
   class  management-traffic
       priority 64         ! Priority queue, exactly 64K for network management
                               ! note this is both a reservation and effectively a limit.
   class  staff-traffic
       bandwidth 256  ! reserve 256K queue for staff web traffic,
                              ! if the queue is full, its traffic can go into other queues
   class  tenant-traffic
       bandwidth  256 ! 256K queue for tenant web traffic
   class  class-default
       ! Default gets best effort
       fair queue        ! Apply Fair queuing to the rest of it
       ! An example of Policing, which can be used to actually
       ! cap usage;  I probably wouldn't include this here,
       ! it's more useful if you identify a specific protocol or interface
       !  as needing to be capped.
       police rate percent 98 peak-rate percent 100
            conform-action transmit
            exceed-action drop


(3) Apply the policy to the WAN interface for outboudn traffic. e.g.
interface Serial6/0
service-policy output library-wan-traffic

This deals with outbound traffic your router is SENDING out over the WAN.


(4)  On the other side of the WAN link, apply policies to deal with traffic that will be coming TOWARDS you.
E.g. If your WAN link is a Point-to-Point T1  connection between two locations, it is preferable to have end-to-end QoS,   by having both locations apply a similar policy  for outbound traffic.

Failing that, you may instead specify a policy for INBOUND traffic:

service-policy input  policy-map-name

However,  inbound policies are very limited in what they can do.
In fact,  you can't absolutely STOP  data from being sent towards you,
instead, what you can do with an INBOUND policy is   DISCARD data
that has already been sent over the WAN  destined for your network.

(That means you're throwing away data that's already crossed the low-speed
connection,   in the hopes that throwing it away will slow down TCP connections.)

Because of TCP's behavior when packets are lost, if you police certain traffic, (such as youtube traffic),  the connection speed will reduce.


This works for HTTP, and Web traffic.   It may not work as well when you need to limit certain P2P applications.

Something also to keep in mind is that web traffic is highly symmetrical; the user sends a very small HTTP request which results in a very large HTTP response --  the receiving end is more likely to be the bottleneck in any case.


So you need either your ISP to apply the QoS to traffic coming downstream to you, or  (failing that),   you prioritize your incoming traffic  in such a way that traffic from  the IPs of your checkout system will have higher priority,
and  possibly, you use policing to intentionally  drop traffic to cause the internet video sites to slow down transmissions.


You can quite easily define a  'class'  to include well-known online video sites  and limit just those, of course,   but I would think of that as the last resort