Hi,
some remarks:
You say "I can successfully reach the management ip x.x.0.16 (VLAN 1000 in the Admin context), but I cannot ping the ip (y.y.0.8) on VLAN 100 (Web context)."
In your config, the address in VLAN100 in the web context is not y.y.0.8 but y.y.108.8.
When I ping from the ACE to the gateway y.y.108.2, I do not get a response; however, the correct ARP entry does show up in the ARP table.
In your config, the gateway is not y.y.108.2 but y.y.108.1.
Can you verify this if it are just typos?
Can you post the configuration of you switchports? access in VLAN1000 and trunk in VLAN100.
A assume these VLANs exist in your network?
Thanks,
Dario