class-map match-any A
 match access-group name ACL_A
class-map match-any B
 match access-group name ACL_B
class-map match-any C
 match access-group name ACL_C
class-map match-any D
 match access-group name ACL_D
!
!
policy-map CHILD
 class A
  bandwidth percent 5
  queue-limit 234 packets
 class B
  bandwidth percent 5
 class C
  bandwidth percent 40
  queue-limit 234 packets
 class D
  bandwidth percent 40
  queue-limit 234 packets
 class class-default
  queue-limit 234 packets
  bandwidth percent 10
!
policy-map PARENT
 class class-default
  shape average 10000000
  service-policy CHILD
!
!
interface Tunnel1
 bandwidth 10000
 ip address x.x.x.x 255.255.255.252
 ip mtu 1400
 ip flow ingress
 ip flow egress
 load-interval 30
 qos pre-classify
 keepalive 3 3
 tunnel source GigabitEthernet0/1.4042
 tunnel destination z.z.z.z
 tunnel path-mtu-discovery
 service-policy output PARENT
!
!
interface GigabitEthernet0/1
 no ip address
 load-interval 30
 duplex auto
 speed auto
!
!
interface GigabitEthernet0/1.4042
 bandwidth 10000
 encapsulation dot1Q 4042
 ip address w.w.w.w 255.255.255.252
crypto map XXXZZZ
!