A customer has a functional requirement that states HR systems within a data center should be segmented from other systems that reside in the same data center and same VLAN. The systems run legacy…

Data center perimeter firewalling only inspects traffic crossing the data center boundary and cannot enforce segmentation between hosts communicating within the same internal VLAN.

Routed firewalls require traffic to traverse a layer-3 boundary between different subnets or VLANs - since the HR and non-HR systems share the same VLAN, traffic does not cross a routed firewall interface.

VACLs are applied directly on the switch at the VLAN level and capture all traffic within a VLAN - including intra-VLAN host-to-host traffic - filtering based on source and destination IP addresses. Since all HR systems and other systems share the same VLAN and the HR systems occupy the 10.20.20.129-254 range, a VACL enforces segmentation without requiring routing changes, VLAN redesign, or external firewall traversal.

Standard ACLs applied to switch interfaces such as SVIs only filter traffic crossing layer-3 boundaries, not intra-VLAN switched traffic between hosts residing in the same VLAN.