How to limit bandwidth for a specific user on a switch or router ?

[Shannon Sutter]

I need help configuring a switch or a router to limit the bandwidth for a specific user/IP when need it.

Most of my remote offices are configured like this:

Users ------ 3560 switch ------- 2801 router -------- T1 to NOC -------- 7204 router with channelized DS3

I use Netflow Analyzer for high bandwidth usage alerts and can see the user's IP right away when someone is clogging our T1s.

My goal is to be able to temporarily limit the bandwidth of the user taking over the T1. 

Whatever is best switch config or on the router.

I've been reading lots of threads but have not found a simple way to achieve my goal.

I did find similar threads but with links to documents not working.

Any help would be appreciated.

Thanks in advance

Zeek

[Reza Sharifi]

Here is an example of rate limiting on an interface

In  this example (Figure 7), two flow masks will be combined to limit  traffic to and from users in the computer science faculty. Each user  (student) will be limited to uploading or downloading no more than 1 Mb  of data. The computer science faculty uses the 202.25.1.0/24 subnet. In  order to achieve this, the following configuration could be applied:

6500(config)# access-list 142 permit ip 202.25.1.0 0.0.0.255 any

6500(config)# access-list 143 permit ip any 202.25.1.0 0.0.0.255

6500(config)# class-map identify-outbound-student

6500(config-cmap)# match access-group 142

6500(config)# class-map identify-inbound-student

6500(config-cmap)# match access-group 143

6500(config)# policy-map police-student-traffic-outbound

6500(config-pmap)# class identify-outbound-student

6500(config-pmap-c)# police flow mask src-only 1000000 1000 conform-action transmit exceed action drop

6500(config)# policy-map police-student-traffic-inbound

6500(config-pmap)# class identify-inbound-student

6500(config-pmap-c)# police flow mask dest-only 1000000 1000 conform-action transmit exceed action drop

6500(config-pmap-c)# interface gig8/22

6500(config-if)# service-policy input police-student-traffic-inbound

6500(config-pmap-c)# interface gig8/23

6500(config-if)# service-policy input police-student-traffic-outbound

link:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd803e5017.html

Also, a link to car:

http://www.cisco.com/en/US/docs/ios/11_1/feature/guide/CAR.html

HTH

[Shannon Sutter]

To  Reza Sharifi

The example you posted is not supported on 3560 switches.

Notice, when I opened this thread I pasted my topology.