I'm hoping to get some advice regarding the best practice to delegate a limited Internet connection between two VLANs. In my case, one VLAN is for an office network, and the other is for guests. What I'm hoping to do is allow a certain percentage of bandwidth to the Office network with priority over the Guest network. For example if I have a 10Mbps down speed, I'd like up to 7Mbps of that to always be available to the Office if needed, otherwise, the guest connection could use it.

My main concern is that if I rate limit the guest network to say 3Mbps and the router start to drop packets over that limit, that I am wasting packets from the ISP. If I understand correctly, the ISP would be sending at say 10Mbps, then my router starts dropping anything over that limit to the guest network, isn't that wasted bandwidth that will have to be resent?

In short, rate-limiting the upload makes a lot of sense because I have full control over that with my router, but I'm not sure you can effectively rate limit down-stream traffic from the ISP as I have no control over their routers. So if you can rate limit down-stream traffic without wasting it, how do you recommend going about it?


  • If you use a policy you can guarantee 7 Mbps to the office and when there is no congestion the bandwidth is up for grabs. Can you provide a simple diagram? Both VLANs will terminate on that router?
    – Daniel Dib
    Commented Oct 2, 2013 at 18:16
  • The basic setup is a DSL line coming into a 881 router which has two VLANs, 10 for office and 20 for guest. From the 881 router there are two uplinks to one 2950 24port switch (one uplink is VLAN 10, the other is 20). All of the clients connect to the 2950 switch which has both VLAN 10 and VLAN 20 ports. If I use a policy to guarantee 7Mbps out of the 10 available to the Office, what would happen if the Guest was trying to pull faster than 3Mbps when the Office was using it's guaranteed 7? If the router drops incoming packets from the ISP, doesn't that defeat the purpose of the QoS? Commented Oct 2, 2013 at 18:57
  • It could be an option, what is your idea? Commented Oct 2, 2013 at 19:29

1 Answer 1


Unfortunately, I don't think there's a good way to do what you want without the provider's involvement. Working within that restriction, your best bet may be to implement an outbound policy on your LAN interface. For example, if you are PATing the business network and guest networks separately, so that the return traffic can be identified by destination IP, then a hierarchical policy that guarantees bandwidth to the business network will help. Essentially, the parent policy would shape all traffic to 10 Mbps. The parent would then call a child policy that guarantees 7 Mbps for the business network. The remaining traffic (guest network) would then be able to use whatever is left over.

Keep in mind that this is imperfect, since the traffic has already traversed the WAN. However, if the guest traffic is TCP, and starts getting dropped by your outbound LAN policy, the TCP session should throttle itself. This won't work for UDP at the transport layer.

A sample policy would look something like this:

ip access-list extended BUSINESS-NETWORK 
 permit ip any host
 match access-group name BUSINESS-NETWORK 
policy-map PARENT 
 class class-default 
  shape average 10000000
  service-policy CHILD
policy-map CHILD 
  bandwidth 7000 
interface Fa0/0 
 description LAN interface 
 ip address x.x.x.x 
 service-policy output PARENT

This is an imperfect example, but is the best I can come up with without provider involvement.

  • Thanks for much for your response Ryan. To be clear, if I rate limit the Guest network inbound traffic to 3Mbps on the LAN interface, wouldn't the WAN interface still try to pull at 10 (Assuming a 10Mbps pipe down) then, once the traffic hits the LAN guest interface, start dropping anything over 3? Or does having a 3Mbps rate limit on the LAN interface make it so it would only pull at 3Mbps from the ISP? Commented Oct 2, 2013 at 19:00
  • The answer to your first question is yes. You are essentially rate-limiting your outbound traffic. For all intents and purposes, this will have no impact on your inbound traffic. I'm going to edit my original answer to account for egress shaping on your LAN interface, which could help (but not completely solve) your problem.
    – Ryan
    Commented Oct 2, 2013 at 19:12
  • Thanks for the example configuration Ryan, this gives me a good starting point to continue working with. Greatly appreciate your time and help! I'd up-vote you if I could but don't have enough rep! :) Commented Oct 2, 2013 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.