ACLs on switches filter traffic at Layer 2 and Layer 3. Port ACLs restrict host access, VLAN ACLs filter inter-VLAN traffic, and router ACLs secure Layer 3 boundaries.

VLANs segment broadcast domains. Trunks carry multiple VLANs between switches. Misconfiguring either causes connectivity issues that are notoriously hard to debug.