Where to place a VACL

[glsparks]

Hi 

I'm looking to implement a VACL on a vlan to prevent three hosts talking to each other.

Now on hosts is on different switches connected via the core/distribution switch, the core hosts the VLAN SVI and default gateway.

So my question is. Does the VACL need to be on all 3 switches? 

Thanks in advance

[MHM Cisco World]

host in same VLAN ? or in different VLAN ?

[glsparks]

Same VLAN.

[MHM Cisco World]

then use VLAN access-map
try use MAC if the three host get IP from DHCP server not static config 
VLAN access-map (VACL) Example Configuration on Cisco Switch (networkstraining.com)

you can also use Port ACL in each port connect to host to permit or deny traffic 

[glsparks]

My question is actually not how to do it but where to put the configuration.

Is the configuration applied to all switches that have the VLAN on or only switches that have the hosts attached?

[MHM Cisco World]

if that case then you need to config in VLAN in all SW, if the host in SW1 connect to host in SW2 the there is chance that the traffic bridge in SW2 not in SW1
So
I prefer you use Port ACL.