Symptom
ip access list ACL
5 deny ip X.X.X.X/32 any
vlan access-map ACCESSMAP 10
match ip address ACL
action forward
(config)# vlan filter ACCESSMAP vlan-list X
Deny is not supported on VACL. Please check your configuration. <<<
Conditions
VACL with an ACL that contains a deny statement
Workaround
Use ACL with permit statement and action drop instead
(e.g)
ip access list ACL
5 permit ip X.X.X.X/32 any
vlan access-map ACCESSMAP 10
match ip address ACL
action drop
vlan filter ACCESSMAP vlan-list X <<<< This works
Further Problem Description
Need to update the documentation to make clear deny statements on VACL are not currently supported.
