I classify in both directions. Here is an example protecting 60% of the bandwidth for Microsoft RDP traffic, alloting 10% to telnet traffic, and 5% at less than best effort to printer traffic:
class-map match-any SILVER-IN
match access-group name SILVER-IN
class-map match-any LTBE-IN
match access-group name LTBE-IN
class-map match-any GOLD-IN
match access-group name GOLD-IN
class-map match-any LTBE
description Desktop Printing data
match access-group name LTBE
match ip dscp 6
class-map match-any SILVER
match access-group name SILVER
match ip dscp af11
class-map match-any GOLD
description RDP Traffic
match access-group name GOLD
match ip dscp af21
!
!
policy-map WAN-EDGE-IN
class LTBE-IN
set ip dscp 6
class GOLD-IN
set ip dscp af21
class SILVER-IN
set ip dscp af11
class class-default
set ip dscp default
policy-map WAN-EDGE
class GOLD
bandwidth percent 60
class SILVER
bandwidth percent 10
class LTBE
bandwidth percent 5
class class-default
fair-queue
interface FastEthernet0/1
service-policy input WAN-EDGE-IN
!
interface ATM2/0.10 point-to-point
pvc my_pvc 1/10
vbr-nrt 384 270 36
service-policy output WAN-EDGE
ip access-list extended GOLD-DATA
permit tcp any eq 3389 any
permit tcp any any eq 3389
ip access-list extended GOLD-DATA-IN
permit tcp any eq 3389 any
permit tcp any any eq 3389
permit udp any eq 3389 any
permit udp any any eq 3389
ip access-list extended LESS-THEN-BE-DATA
permit tcp any eq 9100 any
permit tcp any any eq 9100
ip access-list extended LESS-THEN-BE-DATA-IN
permit tcp any eq 9100 any
permit tcp any any eq 9100
permit udp any eq 9100 any
permit udp any any eq 9100
ip access-list extended SILVER-DATA
permit tcp any eq telnet any
permit tcp any any eq telnet
ip access-list extended SILVER-DATA-IN
permit tcp any eq telnet any
permit tcp any any eq telnet
