hey,
Being able to do this as close to the customer as possible is always most effective, especially if you run LAG's between a switch and upstream router.
DDoS can be a problem in this scenario. Assuming the PEs have plenty of capacity available and you can afford DDoS to reach PE, then you would shape to customer contract speed, drop the DDoS traffic and would not congest your access device uplink.
-- tarko
