Rate policy with 0 guaranteed, burstable, medium priority.
Partition to contain the aggregate of all users

Rate policy with 25 Kbps guaranteed (or the minimum, per-session amount needed for acceptable performance), burstable, medium-to-high priority, and a cap, perhaps 60 Kbps, that prevents sessions from getting bandwidth beyond that which improves reception.
Priority policy for the control flows (as opposed to the flows of data) with a high priority.
Partition with a size that accommodates the maximum number of allowed users with minimum per-session bandwidth (500 Kbps for 20 users, for example).
Admission Control to refuse more than the maximum number of users (or redirect them).

Rate policy with 0 guaranteed, burstable, priority 0, and 2 Kbps cap (or the per-session amount you'd like to give).
Partition to contain the aggregate of all users to less than 3 percent of capacity (or lower, if desired).

Web browsing, to a web server (get requests, typically one packet)

Voice over IP

Voice clients typically use UDP streams. H.323, the industry standard, starts a conversation on one port (H.323), jumps to another port (Q.931), and eventually splits up into a data flow (RTP) and control flow (RTCP).

Note: Video over IP is managed similarly, except the bandwidth amounts are greater. For help and details, see Manage Voice and Video Sessions.

Rate policy with a guaranteed rate (see next comment), burstable at a high priority for the data flows.

For determining the guaranteed rate, use the Monitor Traffic window to look at several RTP flows. Observe usage characteristics (current, one-minute average, and peak rate). Typically, if a manufacturer claims that its flow requires 8 Kbps, it will actually need 17 to 21 Kbps due to additional overhead and forward error correction. In addition, it is best to overstate the guarantee in rate policies for UDP traffic by 15 to 20 percent.

For example: Rate policy with 25 Kbps guaranteed, burstable at 6.

Note: Many links do not deliver full-rated bandwidth. For instance, if you have a 128 Kbps link and are running sustained streaming traffic (such as voice), you will probably need to set the link speed 10 percent lower than actual capacity. This lower rate reflects the overhead for framing and routing updates running on the same line. This is critical for slower (sub-T1) links.

Rate policy: 5 to 20 Kbps guaranteed, burstable, priority 4 or 5. If you have a slow link or a larger number of concurrent Citrix users, use less guaranteed rate.

Partition on the Citrix parent class of 25 to 50 percent of the link size, burstable, no limit.

It's impossible to suggest one management strategy for all encrypted traffic because its characteristics and needs vary, just as those for unencrypted traffic vary.

If the encrypted traffic is bursty, batch-oriented, and uses TCP (such as FTP over SSL), use a rate policy.

If it's not bursty and doesn't use TCP (such as an IPSec tunnel of Telnet traffic), use a priority policy.

A partition on IPSec to protect (if it needs protection) and/or to contain (if other traffic's performance is impacted by IPSec's bandwidth demands) is appropriate.

A rate policy with guaranteed bandwidth is usually not appropriate for IPSec traffic, as it may not need the reserved amount or it may need more than what is allocated. A priority policy is a better choice.