Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
For what specific platforms (and their IOS versions)? (Cisco QoS features vary per platform and IOS versions.)
What's you physical hand-off? If greater than 4 Mbps, you'll want to shape, but with a hierarchal policy, (What you have now would not trigger your non-default classes until the interface congests.
If your physical hand-off is 4 Mbps, than you don't need to shape at all.
Normally you wouldn't use LLQ for something like VPN traffic. Also LLQ has an implicit policer, when a) you might be better shaping for your 1.5 max, and b) and the policer will police at 1 Mbps.
Your other classes have bandwidth floors, no maximums (as you say you want).
You set DSCP for class-default, but don't set DSCP for any of the other classes?
Again, it would be relatively easy to help you with a good egress policy, but what about ingress? For example, you've placed VPN into LLQ for egress, but your Guest-Internet could flood your ingress disrupting end-to-end quality for other traffic.
What you're trying to do will only work well (with stock Cisco equipment) if your can control ingress too, which normally requires full control over the other side's egress. Generally you don't have that with any kind of generic Internet traffic.
There are 3rd party traffic appliances that might help. But, other than those, if you want effective QoS, you need to be able to manage all your traffic in both directions.
