Rate-limiting on Cisco router

[xenolith]

I have a customer who services its own customers with internet. It is a small business development center. Currently the setup works by me providing a T1 to the location and they distribute internet to the tenants using ethernet. Now my customer has ran into the problem of some users using all the bandwidth and is asking me about rate-limiting to sell different classes of service to their customers.

Ideally I would like to rate-limit at the switch ports which service the rooms but I do not believe their switchs support anything like this. This leaves me with the option of doing it at the router, if possible. I have never worked with rate-limiting so please excuse my ignorance.

My thoughts are to have 3 classes of users - those which get 256k, 512k and 1.0m of internet bandwidth. Then I would assign IP addressing based on which class they paid for. I assume I would build 3 access lists of varying sizes for the different classes and then use multiple rate-limit commands on the appropriate interface to achieve this?

Maybe:
access-list 1 permit 192.168.1.2 0.0.0.98
access-list 2 permit 192.168.1.101 0.0.0.74
access-list 3 permit 192.168.1.175 0.0.0.74

interface FastEthernet0/0
rate-limit output access-group 1 256000 0 conform-action transmit exceed-action drop
rate-limit output access-group 2 512000 0 conform-action transmit exceed-action drop
rate-limit output access-group 3 1024000 0 conform-action transmit exceed-action drop

(I know those ACLs may not be valid, but this is just an example I thought of while off work today.)

Am I going about this the right way or does anyone have a better recommendation?

At this point I am mostly looking into what will be required so I can make a recommendation to my customer. Currently a Nortel router, which does not support rate-limiting, is installed at the site so some equipment upgrades will be required. I am just trying to find out if my idea of doing it at the router would work or if I need to tell them to replace several switchs.

Thanks,
Josh

 

[KiscoKid]

There's nothing wrong wat all ith your approach to this issue. The only thing I would say is that Cisco would probably encourage you to use traffic policing rather than rate limiting nowadays (URL below shows how to set it up - as you can see however it's doing the same thing)

http://www.cisco.com/en/US/tech/tk6...tech_note09186a0080120f48.shtml#anti_spoofing

If you don't want to drop user traffic as rate-limiting/policing tends to do, you can consider traffic shaping instead (URL below)

http://www.cisco.com/en/US/products...figuration_guide_chapter09186a00800bd8f1.html