Traffic Shaping

[omega]

Hello.

When setting a Traffic-Shaping Policy do source and destination match the firewall session or the flowing packets?

For example when client accesses a webserver then I would do a firewall policy with source "client" and dst "webserver" to allow access. When I want to limit download rate would that mean to set exactly the same within traffic shaping and apply a reverse shaper or do I have to set source to "webserver" and dst to "client" and add a normal shaper?

The question is caused by shapers not really working on an ipsec vpn when session is started at remote location and traffic should be limited on the local wan-interface.

Thanks for help