gned as router ACLs. When configuring router ACLs, you have the option to apply the ACLs outbound (though I'm not a big fan of outbound ACLs): IOS-3750(config-if)#1p access-group Permit-Bob out Remember that applying an ACL to any Layer-3 interface will make the ACL a router ACL. Be careful when applying port ACLs and router ACLs together: 2w3d: %FM-3-CONFLICT: Input router ACL Permit-Bob conflicts with port ACLs This error message indicates that port ACLs and router ACLs are in place with over- lapping ranges (in this case, the same IP addresses). This message is generated because both ACLs will be active, but the port ACL will take precedence. Having a port ACL in place while a router ACL is also in place can cause a good deal of confusion if you don't realize the port ACL is in place. Configuring VLAN Maps VLAN maps allow you to combine access lists in interesting ways. VLAN maps filter all traffic within a VLAN. A port ACL filters only inbound packets on a single interface, and a router ACL filters packets only as they travel into or out of a Layer-3 interface. A VLAN map, on the other hand, filters every packet within a VLAN, regardless of the port type involved. For example, if you create a filter that prevents MAC address 1111.1111.1111 from talking to 2222.2222.2222 and apply it to an interface, moving the device to another interface will bypass the filter. But with a VLAN map, the filter will be applied no matter what interface is involved (assuming it was in the configured VLAN). For this example, we'll create a filter that will disallow AppleTalk from VLAN 100. Here's the MAC access list: S-3750(config) #mac access-list extended No-Appletalk I0S-3750(config-ext-macl)#permit any any appletalk Notice that we're permitting AppleTalk, though our goal is to deny it. This is due to the nature of VLAN maps, as you're about to see. To deny AppleTalk within the VLAN, we need to build a VLAN map. VLAN maps have clauses, similar to route maps. The clauses are numbered, although unlike in a route map, we define th