ssigned as router ACLs, while MAC ACLs cannot. Router ACLs can be applied in both inbound and outbound directions. VLAN maps VLAN maps are similar in design to route maps. VLAN maps are assigned to VLANs, and can be configured to pass or drop packets based on a number of tests. VLAN maps control all traffic routed into, out of, or within a VLAN. VLAN maps have no direction. Configuring Port ACLs Port ACLs are ACLs attached to a specific physical interface. Port ACLs can be used to deny a host within a VLAN access to any other host within the VLAN. They can also be used to limit access outside of the VLAN. Imagine that VLAN 100 has many hosts in it, including host A. Host A should not be able to communicate directly with any of the other hosts within the same VLAN; it should only be able to communicate with the default gateway, to communicate with Chapter 23: Access Lists the rest of the world. Assume that host A's IP address is 192.168.1.155/24, the default gateway's IP address is 192.168.1.1/24, and host A is connected to port G0/20 on the switch. The first step in restricting host A's communications is to create the necessary ACL. You must allow access to the default gateway, then deny access to other hosts in the network, and, finally, permit access to the rest of the world: access-list 101 permit ip any host 192.168.1.1 access-list 101 deny ip any 192.168.1.0 0.0.0.255 access-list 101 deny ip any any Once you've created the ACL, you can apply it to the physical interface: 3750(config)# int go/20 3750(config)# switchport 3750(config-if)# ip access-group 101 in Notice that even though this is a layer-2 switch port, a layer-3 IP access list can be applied to it. The fact that the IP access list is applied to a switch port is what makes it a port ACL. Port ACLs can also be MAC-based. Here's a small MAC access list that denies AppleTalk packets while permitting everything else: mac access-list extended No-Appletalk deny any any appletalk permit any any Assigning this access list to an interface makes it a port ACL