The attached document was written for a NA customer with Guest WLAN's tunneled back to the controller. The general principles of using rate limiting and ACL's to control the amount of traffic that the data plane must forward apply to all tunneled WLAN's Most of the content was gathered through discussions with Kevin Marshall...so most of the credit for any useful information sould be attributed to him. Any misinterpertations  or omissions  are my responsibility