e action within the clause, not in the clause's title. First, we need to define the VLAN map, which we do with the vlan access-map com- mand. This VLAN map will have two clauses. The first (10) matches the MAC access list No-Appletalk and drops any packets that match. This is why the access list needs ACLs in Multilayer Switches to contain a permit appletalk instead of a deny appletalk line. The permit entry allows Apple Talk to be matched. The action statement in the VLAN map actually drops the packets: vlan access-map Limit-V100 10 action drop match mac address No-Appletalk Next, we'll add another clause that forwards all remaining packets. Because there is no match statement in this clause, all packets are matched: vlan access-map Limit-V100 20 action forward Here's the entire VLAN map: vlan access-map Limit-V100 10 action drop match mac address No-Appletalk vlan access-map Limit-V100 20 action forward Now that we've built the VLAN map, we need to apply it to the VLAN. We do this the vlan filter global command: IOS-3750(config)#vlan filter Limit-V100 vlan-list 100 To apply a VLAN map to multiple VLANs, append each VLAN number to the end of the command. You may be wondering, couldn't we just make a normal access list like the following one, and apply it to specific interfaces? mac access-list extended No-Appletalk deny any any appletalk permit any any The answer is yes, but to do this, we'd have to figure out which interfaces might send Apple Talk packets, and hence, where to apply the list. Alternatively, we could apply it to all interfaces within the VLAN, but then we'd need to remember to apply it to any ports that are added to the VLAN in the future. Assigning the access list to the VLAN itself ensures that any AppleTalk packet that arrives in the VLAN, regardless of its source or destination, will be dropped. To see which VLAN maps are assigned, use the show vlan filter command: IOS-3750#sho vlan filter VLAN Map Limit-V100 is filtering VLANs: Chapter 25: Access Lists Reflexive Access Lists Reflexive access