So I got stuck for a good half hour with a new 3850 stacked setup, rather than use a switch port to access for management whilst the switch wasn’t live i thought why not access the box via it’s dedicated routed management port but low and behold ssh connection refused, hmmm, what exactly am I missing?
Turns out all it was was this “vrf-also” keyword on my access class. Annoying.
access-class 1 in vrf-also
Found it through the cisco support forums.