750(config)# vlan filter Limit-V100 vlan-list 100 To apply a VLAN map to multiple VLANs, append each VLAN number to the end of the command. You may be wondering, couldn't we just make a normal access list like the following one, and apply it to specific interfaces? mac access-list extended No-Appletalk deny any any appletalk permit any any The answer is yes, but to do this, we'd have to figure out which interfaces might send AppleTalk packets, and hence, where to apply it. Alternatively, we could apply it to all interfaces within the VLAN, but then we'd need to remember to apply the access list to any ports that get added to the VLAN in the future. Assigning the access list to the VLAN itself ensures that any AppleTalk packet that arrives in the VLAN, regardless of its source or destination, will be dropped. To see what VLAN maps are assigned, use the show vlan filter command: SW2# sho vlan filter VLAN Map Limit-V100 is filtering VLANs: ACLs in Multilayer Switches Reflexive Access Lists Reflexive access lists are dynamic filters that allow traffic based on the detection of traffic in the opposite direction. A simple example might be, "only allow telnet inbound if I initiate telnet outbound." When I first explain this to junior engineers, I often get a response similar to, "Doesn't it work that way anyway?" What confuses many people is the similarity of this feature to Port Address Translation (PAT). PAT only allows traffic inbound in response to outbound traffic originating on the net- work. This is due to the nature of PAT, in which a translation must be created for the traffic to pass. Reflexive access lists are much more powerful, and can be applied for different reasons. Without PAT, a filter denies traffic without regard to other traffic. Consider the net- work in Figure 23-3. There are two hosts, A and B, connected through a router. The router has no access lists installed. Requests from host A to host B are answered, as are requests from host B to host A. Inside Outside 10.0.0.0/24 20.0.0.0/24 Request Repl