"I have a question. Is it possible to do QoS on internet facing router(using ISR router for example), especially for download?"
Yes, you can. For Internet egress, you can well manage outbound congestion, but, no control beyond that point, so no end-to-end QoS.
For Internet ingress (downloading) it depends on the nature of the traffic and it has "considerations", which often make such QoS, far from "ideal".
For Internet ingress, your best option (beyond getting control over QoS features on the ISP's side of your Internet connection) is using a third party traffic management appliance.
BTW, if you're wondering what your options are, on a Cisco router, for Internet ingress, for traffic that slows when it detects drops, you can police such inbound traffic. When the sender detects drops, it should slow its transmission rate.
For ingress TCP traffic, you can also shape the outbound ACKs. This too should slow the TCP sender's transmission rate.
(NB: I've used both techniques, and they do work.)
Now, regarding "considerations". To insure the ingress traffic doesn't fill your link, before it responds to either packet drops and/or delayed TCP ACKs, you generally need to slow such ingress traffic "a lot". By a "a lot", I mean you might need to target ingress bandwidth to not exceed 10% or even less, of your available ingress bandwidth. Why so much? Several reasons, such as a major one being, the feedback loop, between "signally" the sender to slow its transmission rate, and when it actually does, is "slow". So, what can happen, sender will burst and fill your link before it "knows" it should slow.
Another major reason, TCP will also burst transmit before it too responds to delayed ACKs.
On a Cisco router, you cannot shape outbound ACKs per ingress flow rates, nor easily target particular flows for drops.
I haven't used one, but from what I've read, a dedicated traffic management appliance can do egress ACK shaping and/or drop much more precisely (i.e. tied to individual flow rates). It also can "spoof" the receiver's TCP RWIN, again controlling the sender's transmission rate.
What you cannot do, on either a Cisco router, or traffic shaping appliance is control the rate of non-flow rate kinds of traffic. (Whereas a far side shaper might.)
Another solution to this (common) issue, is obtain more ISP links and dedicate a specific link for specific traffic. This is often a not too expensive solution if you can obtain ISP connection(s) using cable, DSL or FiOS.
Again, it would be a rare ISP which will allow you to define a QoS policy, on their side of your Internet link, but if that's not an option, another possible solution would be for the ISP to allow you to insert a device, on their side of the link, somewhere in-line with the traffic that will be sent down your Internet connection. This too is something that most ISPs will not allow. (Something you might accomplish at a local metro exchange.)
To recap, your most likely best options are usage of a 3rd party traffic management device and/or additional Internet links which are dedicated to specific traffic. (I.e. for the latter, you want to not mix traffic that expands to use all available bandwidth, with those that really need a fixed amount of guaranteed bandwidth.)
Lastly, a "common" solution is to just obtain more bandwidth, but this is often an on-going game. As other Internet sites increase their bandwidth too, they can utilize more of your bandwidth and you once again hit this problem.
