Ji John, > Bring up a GRE tunnel inside the IPSec tunnel. > Then use tc to shape the BW on the tunnel, > Then use tc to shape the BW on the outgoing interface, eg ppp1. I don't see what advantage you get from the nested tunnel configuration you propose - why not simply shape on ppp1 and be done with it? Bye, Martin