ip access-list extended DENY_VLAN21
 deny ip 10.20.21.0 0.0.0.255 10.20.20.0 0.0.0.255
 permit any any
 
int f0/0.20
 ip access-group DENY_VLAN21 out