The VACL configuration in Cisco IOS is based on the traditional IOS ACL implementation. That is, it relies on the IOS access-list command to define the traffic matching parameters. From there, all configuration (including ACL reference and action) is done from the "vlan access-map" configuration mode. (may see http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c8441.shtml)
