ey travel into or out of a layer-3 interface. A VLAN map, on the other hand, filters every packet within a VLAN, regardless of the port type involved. For example, if you created a filter that prevented MAC address 1111.1111.1111 from talking to 2222.2222.2222, and applied it to an interface, moving the device to another interface would bypass the filter. But with a VLAN map, the filter would be applied no matter what interface was involved (assuming it was in the configured VLAN). For this example, we'll create a filter that will disallow AppleTalk from VLAN 100. Here's the MAC access list: mac access-list extended No-Appletalk permit any any appletalk Notice that we're permitting AppleTalk, though our goal is to deny it. This is due to the nature of VLAN maps, as you're about to see. To accomplish the goal of denying AppleTalk within the VLAN, we need to build a VLAN map. VLAN maps have clauses, similar to route maps. The clauses are num- bered, although unlike in a route map, the action is defined within the clause, not in the title of the clause. Chapter 23: Access Lists First, we need to define the VLAN map. This is done with the vlan access-map com- mand. This VLAN map will have two clauses. The first (10) matches the MAC access list No-Appletalk, and drops any packets that match. This is why the access list needs to contain a permit appletalk instead of a deny appletalk line. The permit entry allows AppleTalk to be matched. The action statement in the VLAN map actually drops the packets: vlan access-map Limit-V100 10 action drop match mac address No-Appletalk Next, we'll add another clause that forwards all remaining packets. Because there is no match statement in this clause, all packets are matched: vlan access-map Limit-V100 20 action forward Here's the entire VLAN map: vlan access-map Limit-V100 10 action drop match mac address No-Appletalk vlan access-map Limit-V100 20 action forward Now that we've built the VLAN map, we need to apply it to the VLAN. This is done with the vlan filter global command: 3