Depends what you are trying to do.
vlan 10 = 192.168.5.0/24
access-list 101 deny tcp 192.168.5.0 0.0.0.255 any eq 23
access-list 101 permit ip 192.168.5.0 0.0.0.255 any
int vlan 10
ip address 192.168.5.1 255.255.255.0
ip access-group 101 in
So the above config does 2 things
1) It stops any machine on vlan 10 intiating a telnet connect to any other machine on another subnet
2) It then allows all traffic from any machine on vlan 10 to any other machine. All traffic is any IP traffic other than telnet.
What this access-list does not do is stop any machine on any subnet (other than vlan 10) initiating a telnet connection to machines in vlan 10. If you wanted to do that -
access-list 102 deny any 192.168.5.0 0.0.0.255 eq 23
access-list 102 permit ip any 192.168.5.0 0.0.0.255
int vlan 10
ip access-group 102 out
So it entirely depends on what traffic you are trying to restrict and in which direction.
Jon
