I was trying to rate limit a vlan and found this works a ltitle different than a normal port.  The vlan connections are still able to get full bandwidth bypassing this policer.  I'm not sure why.class-map match-all BYOD-Accesslist  match access-group...

I'm pretty sure I'm on the right track and somewhat close to a correct setup for this.  The goal is to get a wireless controler to route default (safe) traffic on vlan1 and all BYOD traffic (bad) on vlan2.  So far I have the controller tunneling the ...