I think you can create an inbound access-list and apply it to the vlan.access-list 101 deny ip host anyaccess-list 101 permit ip any anyI am assumming that you are using the switch as an L3 switch

Can you please specify the switches that you are using on the LAN. If you are using 3750, then the below link can help.http://www.cisco.com/en/US/products/hw/switches/ps5023/products_tech_note09186a0080883f9e.shtml

You can try the following command to check if there is any NLRI to match the regex expression being used by the as path list.sh ip bgp regexp ^$

Hi Jeff,Can you pls paste the output of the show ip bgp command. I hope you are not using any private AS on the internal routers.

You have not applied the crypto map to the public interface