Hello all, If you are running N3K (all releases) or N5K 5.0(2) and 5.0(3) prior to 5.0(3)N2(1) you'll want to check this one out. Any remarks in your ACLs cause all traffic to bypass subsequent deny statements (including implicit deny statements). http://www.cisco.com/warp/public/707/cisco-sa-20110907-nexus.shtml Regards, Alex White-Robinson.