VACL on 3650 Missing Command

[Ironpudge]

Hello.  I have a Catalyst 3650 Lan Base with Gibraltar 16.12 installed.  Per their configuration guide, https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/16-12/configuration_guide/sec/b_1612_sec_3650_cg/configuring_ipv4_acls.html I should be able to enable a VACL using the command vlan access-map.  When I attempt to use this command, it shows as unrecognized.  If I do vlan ?, I only show accounting, configuration, dot1q, and group.  No access-map option.  I checked the command reference and the feature list, and all show it should be there.  Any thoughts or suggestions?  Thank you.Switching, Catalyst 3000

[balaji.bandi]

is this real gear ? can you post show version ?

[Ironpudge]

Yes, this is physical hardware we have running.  I believe it may be because it is lanbase and not ipbase.  Although if I go to https://cfnng.cisco.com/archived-data and choose my device, IOS XE version, and license of lanbase, it says VACL's are supported.

1840  VLAN Access Control List (VACL)

Also, as I listed in the Security Guide above, it doesn't mention anything about it not being supported.  But doing some additional searching I found https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/16-1/configuration_guide/b_161_consolidated_3650_cg/b_161_consolidated_3650_cg_chapter_01000001.html

It has listed in it:

This section lists the prerequisites for configuring network security with access control lists (ACLs).

On switches running the LAN base feature set, VLAN maps are not supported.

So I assume that is why.

[paul driver]

Hello
whats the current running  sdm template 

show sdm prefer