Hello @no_prop wrote: Hey @luis_cordova. Thanks for taking a look.    Both Vcenter and   UCS_Internal_Management are object groups in Vlan22. UCS_Internal_Management is an object group for Vlan 22's subnet. The other groups are hosts and subnets not in vlan 22. None of the servers can communicate outside the vlan except to hosts and addresses included in an object group defined below. Adding the line permit ip any addrgroup UCS_Internal_Management... allows traffic to exit the network/VLAN22 and obviously defeats the purpose of the ACL.   Thanks again for looking.   IP access list Vcenter_ACL         10 permit ip addrgroup Vcenter any         20 permit ip addrgroup Server_Team any         30 permit ip addrgroup Veeam_System any         40 permit ip addrgroup Radius_ISE any         60 permit ip addrgroup UCS_Internal_Management any         70 permit ip addrgroup SNMP any         80 permit ip addrgroup UCS_Systems addrgroup Vcenter         90 permit ip addrgroup PURE_Array addrgroup Vcenter         100 permit ip addrgroup Unity_Array addrgroup Vcenter         110 permit ip addrgroup 8th_Floor addrgroup Vcenter   Interface Vlan22 ip access-group Vcenter_ACL out Please note the established keyword would be only applicable for tcp, Have a look at the example below to deny your subnets to initiate tcp connection towards vlan22 but to be allowed connection if an established tcp connection from within vlan 22 is initiated. IP access list Vcenter_ACL permit tcp Vcenter any established deny tcp Vcenter any permit tcp Veeam_System any established deny tcp Veeam_System any permit tcp Radius_ISEany established deny tcp Radius_ISEany etc..... permit ip any any int vlan 22 ip access-group Vcenter_ACL out           ... View more

Hello My understanding VSS isnt support on the catalyst 9Ks it only stack-wise virtual ... View more

Hello Remove stp portfast off the trunk towards the AP, shutdown/restart the interface and test again. ... View more