: 3750(config)# int g0/20 3750 (config-if)# mac access-group No-Appletalk in MAC ACLs can be mixed with IP ACLs in a single interface. Here, you can see that the MAC access list and the IP access list are active on the interface: 3750# show run int go/20 interface GigabitEthernet0/20 switchport mode dynamic desirable ip access-group 101 in mac access-group No-Appletalk in Configuring Router ACLs Router ACLs are probably what most people think of when they think of applying ACLs. Router ACLs are applied to layer-3 interfaces. Older routers only had layer-3 interfaces, SO just about all ACLs were router ACLs. If you were to take the previous example, and change the port from a layer-2 interface to a layer-3 interface, the ACL would become a router ACL: 3750(config)# int go/20 3750(config)# no switchport 3750(config-if)# ip access-group 101 in ACLs in Multilayer Switches MAC access lists cannot be assigned as router ACLs. When configuring router ACLs, you have the option to apply the ACLs outbound (though I'm not a big fan of outbound ACLs): 3750(config-if)# ip access-group 101 out Remember that applying an ACL to any layer-3 interface will make the ACL a router ACL. Be careful when applying port ACLs and router ACLs together: 3750(config)# int vlan 100 50(config-if)# ip address 192.168.100.1 255.255.255.0 (config-if)# ip access-group 101 in 2w3d: %FM-3-CONFLICT: Input router ACL 101 conflicts with port ACLs This error message indicates that port ACLs and router ACLs are in place with over- lapping ranges (in this case, the same IP addresses). This message is generated because both ACLs will be active, but the port ACL will take precedence. Having a port ACL in place while a router ACL is also in place can cause a good deal of confusion if you don't realize the port ACL is in place. Configuring VLAN Maps VLAN maps allow you to combine access lists in interesting ways. VLAN maps filter all traffic within a VLAN. A port ACL only filters inbound packets on a single interface, and a router ACL only filters packets as th