In some rate-limit devices, limiting is based on a pool of 'credits'; each packet decreases the pool by x credits and the pool of credits is replenished by y credits per second, up to a maximum value z.
A connection can use all of its credits as quickly as it likes, but packets will be dropped if there are no credits remaining in the pool.
In implementations without a max value, if the connection waits for a long period, it could (in theory) save up a massive pool of credits, and use them all at once, which effectively means it is not rate-limited. In implementations with a max value, the effect of a connection using all its saved credits at once is limited.
In devices that operate under those scenarios, x, y and z are calculated for you, based on the desired police rate and the burst value. The burst value directly affects the max value z.
In practical terms, this should mean that the first 400,000 bytes can go through the router at line rate, after which it is artifically limited to 4,000,000 bits per second. However, because the exact values of x, y and z are derived, there may be some fluctuation in the observed traffic.
(Note, the implementation I am describing is actually hashlimit in Linux's iptables, and I am inferring similar-enough semantics onto the Cisco ISR, based on the rate and burst terms. Cisco, themselves, may have a different algorithm -- I am happy to defer to a definitive Cisco guide. More details of hashlimit can be found here, if you are interested.)
Edit: Cisco documentation mostly seems to agree with me with regards to tokens and cost.
Edit #2: For the second part of your question, regarding splitting the bandwidth between two ports, is this to facilitate two LAN interfaces sharing one outside WAN internet connection? If so (and if your IOS supports it), I might start with something along the lines of:
class-map CLS_VLAN1
match input-interface Ethernet1
class-map CLS_VLAN2
match input-interface Ethernet2
policy-map PMAP_OUTSIDE
class CLS_VLAN1
bandwidth percent 50
class CLS_VLAN2
bandwidth percent 50
interface Ethernet0
service-policy PMAP_OUTSIDE
...although I might be mixing my IOS and ASA command references a little (I haven't got an ISR in front of me to test on.)
Edit #3: I've also seen some reference suggesting that you bandwidth percent values shouldn't add up to more than 75, so you may never get an exact 50/50 split -- 35/35 might be the best you can do.
