Hi, I am trying to stop traffic from reaching a VLAN with the following ACL:

ip access-list my-acl

10 deny 172.16.0.0 0.0.3.255 any

100 permit every

Then it makes sense in my head to add the ACL to the vlan interface inbound but that dosen't work. When I set the ACL outbound on the VLAN interface it does work.

Can anyone explain what I am misunderstanding here as it seems logical that I want to deny source IPs ingress to the interface but that does not seem to be the behaviour here.

Thanks